Cierant Corporation Announces 232,500-Record Data Breach
Cierant Corporation, a Danbury, CT-based distributed marketing software and services company, has recently disclosed a data incident that has affected 232,506 individuals. The data breach was reported separately by its client, Blue Cross and Blue Shield of Massachusetts (BCBSM), as affecting 4,855 of its members.
Cierant explained that it detected a vulnerability in the Cleo VL Trader managed file transfer solution on December 10, 2024. An industry-leading cybersecurity firm was engaged to assist with the investigation and confirmed that the vulnerability had been exploited by a threat actor, resulting in unauthorized access to Cierant’s systems. Cierant did not state what vulnerability was exploited or initial access.
Two vulnerabilities affecting Cleo products were publicly disclosed in December 2024, around the time that the data breach occurred: CVE-2024-50623 and CVE-2024-55956. The first vulnerability allowed files to be uploaded and downloaded from Cleo software. Malicious files could be uploaded that could allow remote code execution. The second vulnerability allows Bash and PowerShell commands to be run on the host system. Exploitation activity in Cleo products has been linked with the Clop threat group, which frequently targets vulnerabilities in file transfer solutions. Clop’s previous mass exploitation campaigns include zero-day vulnerabilities in Progress Software’s MoveIT Transfer solution and Fortra’s GoAnywhere MFT solution.
Cierant’s review of the affected systems confirmed that they contained information provided by its clients in connection with the services it provides. The types of information involved vary from individual to individual and may include names, addresses, dates of birth, treatment-related dates, generic descriptions of services received, provider names, medical record numbers, health plan beneficiary numbers, claims numbers, and/or plan member account numbers and premium information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Cierant Corporation issued notifications to 232,506 individuals. It is unclear if any clients other than BCBSM chose to issue their own notifications or if any clients not subject to the HIPAA notification requirements were affected.
