Mass General Brigham Health Plan was hit as part of the Cl0p ransomware group's 2023 campaign targeting Progress Software's MOVEit Transfer file transfer platform. Cl0p exploited a zero-day vulnerability in MOVEit to reach patient data held by Welltok, a health engagement and data analytics vendor used by the health plan. The breach exposed records for approximately 4.1 million patients, making it one of the larger incidents tied to that campaign. The exposed data included full names, home addresses, phone numbers, email addresses, and medical diagnoses. The combination of contact details and diagnosis information is particularly sensitive. It creates conditions for targeted phishing, insurance fraud, and medical identity theft, where criminals use someone else's information to obtain care or file false claims. The prestige of the Mass General Brigham name can also make impersonation scams more convincing to victims. Mass General Brigham notified affected patients and offered credit monitoring services following the breach. The health system is among the named parties in the consolidated MOVEit multidistrict litigation, a federal class action proceeding in the District of Massachusetts involving dozens of organizations affected by the same campaign. Affected individuals should remain alert to unsolicited contacts referencing their medical care, monitor their insurance statements for unfamiliar claims, and consider placing a credit freeze if they have not done so already.

Integrated health systems collect patient identity, contact, insurance, billing, appointment, and clinical records across hospitals, specialty care, and administrative workflows.

Mass General Brigham has continued expanding its ambulatory care and community health footprint while managing cost pressures common across large academic health systems. The system has invested in digital health and research infrastructure. No major organizational changes beyond the breach context have been prominently reported in the recent period.