Centers for Medicare & Medicaid warn 103,000 beneficiaries of unauthorized Medicare.gov account creation
Take action: As an individual, be very careful what data is available online about you. Be very selfish with your data, because it can be abused to impersonate you. As a developer, consider that an attacker can scrape data for someone else, and implement controls that can stop such impersonation by mechanisms for extra verification.
Learn More
The Centers for Medicare & Medicaid Services (CMS) is reporting a security incident of unauthorized creation of Medicare.gov accounts affecting approximately 103,000 beneficiaries across the United States. The incident is a fraud scheme where malicious actors systematically created false online accounts using legitimate beneficiary information obtained from unknown external sources, potentially exposing sensitive healthcare and personal information over an extended period spanning multiple years.
The security incident was discovered on May 2, 2025, when CMS's 1-800-MEDICARE call center began receiving inquiries from confused beneficiaries who had received official letters confirming the creation of Medicare.gov accounts they had never initiated.
The CMS investigation discovered that malicious actors had fraudulently created new accounts between 2023 and 2025 using valid beneficiary information, including Medicare Beneficiary Identifiers, coverage start dates, last names, dates of birth, and zip codes. The systematic nature of the account creation and the extended timeframe indicate an organized and persistent scam campaign.
Once the unauthorized accounts were established, the threat actors gained access to additional sensitive information stored within the Medicare system, significantly expanding the scope of potentially compromised data which can be used for identity theft, healthcare fraud, or other criminal activities. Exposed data includes:
- Medicare Beneficiary Identifiers (MBI)
- Coverage start dates
- Last names
- Dates of birth
- Zip codes
- Mailing addresses
- Provider information
- Dates of service
- Diagnosis codes
- Services received
- Plan premium details
The incident affected approximately 103,000 Medicare beneficiaries whose personal information was used to create the fraudulent accounts. CMS has stated it is not aware of any reports of identity fraud or misuse of the information as a direct result of this activity.
Following detection of the incident, CMS deactivated all fraudulently created Medicare.gov accounts and implement additional security measures including disabling the ability to create new Medicare.gov accounts from non-US IP addresses. The agency is also monitoring Medicare claims data for suspicious activity and has implemented enhanced verification procedures for new account creation to prevent similar incidents in the future.
CMS is mailing written notifications to all potentially affected beneficiaries, providing detailed information about the incident, outlining the steps being taken to protect their information, and offering guidance on additional protective measures they can take.
