IBM: the firm that prices everyone’s breach, graded on its own house

IBM provides services to the Colorado Department of Health Care Policy & Financing (HCPF), the state’s Medicaid agency, and used Progress Software’s MOVEit Transfer to move HCPF data files. In the mass exploitation of the MOVEit zero-day (CVE-2023-34362) by the Cl0p ransomware gang, files IBM was transferring were accessed by an unauthorized actor on or about May 28, 2023; HCPF identified the access on June 13, 2023. HCPF stated “certain HCPF files on the MOVEit application used by IBM were accessed,” and that no HCPF systems were impacted. IBM told SecurityWeek it worked with the affected agencies and that “there has been no impact to IBM systems.”

HCPF notified close to 4.1 million individuals (Health First Colorado / Medicaid and Child Health Plan Plus members), beginning August 11, 2023. Reported data fields include names, addresses, dates of birth, Social Security numbers, demographic/income information, clinical and medical data, Medicaid/Medicare IDs and health insurance information — among the most sensitive categories there are. The breach was of client data IBM was processing, not of IBM’s own corporate network — which is precisely the third-party/processor exposure IBM’s own reports warn about.

Missouri’s Department of Social Services (DSS) disclosed on August 8, 2023 that IBM Consulting, a DSS vendor, had informed it that MOVEit data IBM handled was accessed in the same campaign. DSS said its own systems were not breached, but that data on the MOVEit server was affected. IBM confirmed to SecurityWeek that it worked with DSS as well as with Colorado.

DSS said it was notifying all Missouri Medicaid recipients as a precaution; a final affected count was not publicly confirmed at disclosure. The MOVEit server reportedly held names, DSS client numbers, dates of birth, benefit eligibility/coverage status and medical-claims information. Two state Medicaid agencies exposed through one vendor’s file-transfer tool is a textbook concentration-of-risk / supply-chain story.

A former IBM vice president of threat intelligence, William Barlow, alleges in a complaint (originally filed under seal in 2020, unsealed and reported in June 2026) that IBM and AT&T gave false assurances about the security of cloud systems IBM operated — including for the federal government — and concealed repeated intrusions from regulators and government clients. Barlow ties the matter to the APT10 campaign the U.S. Justice Department described in 2018, alleging an internal investigation found more than 50,000 “potential APT 10 hits” between 2013 and 2016, and that IBM did not retain access logs. IBM says it “is confident that our actions followed the letter of the law.”

These are untested allegations from civil litigation, not findings. The U.S. Department of Justice declined to intervene, and the case is reported as still pending. IBM denies wrongdoing. The specific intrusion counts and the concealment claim are the plaintiff’s characterizations and should not be read as established fact — they are included here only as a disputed, dated claim, flagged as such.