Mass General Brigham Health System Breach (2023): 4 Million Patient Records Including Medical Diagnoses Exposed — Title missing 'Exposed'

About Mass General Brigham

Mass General Brigham is a Boston-based integrated health system formed through the affiliation of Massachusetts General Hospital and Brigham and Women's Hospital, two of the most prominent academic medical centers in the United States. The system operates more than a dozen hospitals and hundreds of outpatient locations across Massachusetts and beyond, with a combined clinical, research, and education mission. It is affiliated with Harvard Medical School and consistently ranks among the top hospital systems in national quality assessments.

Why They Hold Your Data

Integrated health systems collect patient identity, contact, insurance, billing, appointment, and clinical records across hospitals, specialty care, and administrative workflows.

Recent Developments

Mass General Brigham has continued expanding its ambulatory care and community health footprint while managing cost pressures common across large academic health systems. The system has invested in digital health and research infrastructure. No major organizational changes beyond the breach context have been prominently reported in the recent period.

Data Points Exposed

Breach Impact

The 2023 incident was part of the Cl0p ransomware group's zero-day exploitation of Progress Software's MOVEit Transfer platform, accessed through Welltok — a health engagement and data analytics vendor used by Mass General Brigham Health Plan. The breach compromised patient data for approximately 4 million individuals including names, email addresses, phone numbers, home addresses, and medical diagnoses. Mass General Brigham notified affected patients, offered credit monitoring services, and reported the incident to relevant regulators. The system is a named party in the consolidated MOVEit multidistrict litigation in the District of Massachusetts, alongside dozens of other healthcare organizations caught in the same campaign.

Exploitation & Downstream Threats

• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure | • Medical identity fraud or insurance abuse using health data

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Watch for medical-benefit fraud and health-themed phishing that references real provider relationships.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).