File Transfer Flaw Blamed in Health Breach Affecting 233,000

A Connecticut-based firm that provides print and electronic document management services to health plans has reported to regulators that an exploit of a vulnerability in file transfer software from third-party vendor Cleo has resulted in a health data compromise affecting nearly 233,000 people.

See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments

Cierant Corp. reported the data breach to the U.S. Department of Health and Human Services on July 3 as a hacking incident involving a network server. The company’s breach notice said the hack was the result of an exploit of a vulnerability in third-party transfer tool VLTrader by Cleo.

Cleo VLTrader is a server-side enterprise managed file transfer solution designed for mid-enterprise organizations.

“Cierant detected this vulnerability on Dec. 10, 2024,” the company said. Cierant’s investigation into the incident, with assistance from a third-party cybersecurity firm, found that an unauthorized actor exploited the vulnerability to gain limited access to Cierant systems, resulting in the potential compromise of personal and health data.

“This personal data was processed by Cierant on behalf of third-party health plans. Cierant notified and then worked with these health plans to identify and notify potentially affected individuals,” Cierant said.

Information potentially affected varies among individuals, but potentially includes name, address, date of birth, treatment-related dates, a generic description of services received, provider name, medical record number, health plan beneficiary number, claims number and/or plan member account number and premium information.

“There is no indication that this information has been or will be misused at this time,” Cierant said.

Cierant did not immediately respond to Information Security Media Group’s request for additional details about the incident, including whether clients or individuals in other industries that the company serves were affected by the hack.

Bethel, Conn.-based Cierant also provides services to the consumer retail and publishing industries.

MFT Hacks

Last December, hackers were found exploiting two vulnerabilities in Cleo products.

Security firm BlackKite said that included CVE-2024-50623, which contained a flaw that permits unrestricted file uploads and downloads. The flaw enabled attackers to upload malicious files that result in remote code execution.

The other vulnerability, CVE-2024-55956 targets the default configuration of the auto run directory. Attackers who exploit this vulnerability can execute Bash or PowerShell commands on the host system by using the system’s behavior of automatically processing files placed in a predetermined directory, BlackKite said (see: Hackers Exploiting Cleo Software Zero Day).

Security firm Huntress in December said it first identified the vulnerabilities affecting Cleo’s LexiCom, VLTransfer and Harmony software products. Privately held, Illinois-based Cleo had published a patch in October – but the fix “does not mitigate the software flaw,” Huntress wrote.

Cleo subsequently updated the patch, “strongly” advising all its customers to immediately upgrade instances of Harmony, VLTrader and LexiCom to the latest released patch – version 5.8.0.21 – to address additional discovered potential attack vectors of the vulnerability.

Cleo did not immediately respond to ISMG’s request for additional information pertaining to the status of the vulnerability and the number of clients reporting breaches involving exploits of the zero-day.

Early on, researchers said cybercriminal groups potentially exploiting the Cleo vulnerability included Termite and especially Clop ransomware operations (see: Attack Exposure: Unpatched Cleo Managed File Transfer Software).

Cierant is not the first organization to report a major health data breaches involving the Cleo vulnerability.

In May, Missouri-based Ascension Health notified nearly 440,000 patients of a compromise involving a former business partner and a potential exploit of the Cleo software vulnerability (see: Ascension: Software Exploit Breach Affects Nearly 440,000).

In May, BlackKite had estimated that the number of Cleo victims had climbed to nearly 400 by February.

Of course Cleo is not the first managed file transfer software company experiencing hacks involving exploitation of vulnerabilities in their products.

MOVEit, developed by Massachusetts firm Progress Software, has a history with such incidents (see: Scans Probing for MOVEit Systems May Be Precursor to Attacks).

Also, vulnerabilities in Fortra software vendor’s managed file transfer software GoAnywhere were also at the center of 2023 hacking incidents reported by organizations in healthcare and many in other sectors (see: Clop Ransomware Claim Widespread GoAnywhere MFT Exploits).

Managed file transfer software continues to be a desired target for many adversaries, some researchers said.

“Ransomware groups favor these products as they typically host the files they are designed to transfer, allowing a threat actor to either exfiltrate or potentially encrypt the compromised server’s sensitive data,” said Stephen Fewer, principal security researcher at Rapid7.

“Some file transfer solutions also contain credentials to other storage solutions, allowing an attacker with a foothold to pivot further into a corporation’s network,” he said.

“Organizations should ensure they are running the latest version of the software,” he said. In the case of Cleo, if they are running an older version of the company’s VLTrader, Harmony or LexiCom with the CVE-2024-55956 vulnerability, “then they should conduct a compromise assessment to evaluate if their servers have been exploited, as public exploit code for this vulnerability has been available for almost seven months now.”

In general, to reduce the risk of their file transfer software being exploited, customers of these products should first ensure they update their file transfer products to the latest vendor-supplied versions as a priority with the organization’s update cycle, he said.

“Where possible, these products should not be exposed to the public internet. Placing file transfer solutions behind a VPN may help limit exposure, although often given the nature of these products, this may not be feasible,” he said.

“Ensuring an EDR solution is running on the server hosting the file transfer product is recommended, along with conducting regular assessments for signs of a breach.”