Approximately 103,000 Medicare beneficiaries are being notified that some of their personal information may have been exposed in a data incident. The HHS Centers for Medicare and Medicaid Services (CMS) was recently alerted that Medicare.gov accounts had been created in individuals’ names without their knowledge. An investigation was launched, which confirmed that a currently unknown threat actor had been using personal information obtained from unknown external sources to fraudulently create Medicare.gov accounts.

The CMS said its Medicare call center started receiving calls on May 2, 2025, from beneficiaries who had been sent a letter confirming that an account had been created in their name, when they had not personally created the account.

An investigation was launched, which revealed malicious actors had fraudulently created Medicare.gov accounts for approximately 103,000 beneficiaries using valid beneficiary information such as their Medicare beneficiary identifier (MBI), coverage start date, birth date, and zip code. The accounts were fraudulently created between 2023 and 2025, and the information used to create the accounts was likely obtained in a third-party data breach.

Once the accounts were created, the threat actor could access further information, including mailing address, diagnosis codes, provider information, dates of service, services received, and premium plan details. The CMS’s investigation has not uncovered any misuse of that information to date, but as a precaution, the affected beneficiaries have been issued a new MBI, and the CMS has deactivated the fraudulently created accounts. New Medicare cards have been mailed to the affected beneficiaries with the new MBIs.

Further actions taken in response to the breach include preventing Medicare.gov accounts from being created using foreign IP addresses and the CMS will continue to monitor claims data for the affected individuals. The affected Medicare beneficiaries are being encouraged to review their Medicare Summary Notices and Explanation of Benefits statements and should report any unfamiliar charges or services.

Source: https://www.hipaajournal.com/cms-unauthorized-medicare-gov-account-creation/