The Colorado Department of Health Care Policy and Financing (HCPF) has disclosed a data breach impacting over 4 million individuals. HCPF manages the Health First Colorado (Medicaid) and Child Health Plan Plus programs along with supporting low-income families, the elderly, and disabled citizens. The agency confirmed that the data breach stemmed from a third-party contractor, IBM, and that HCPF systems were not directly compromised. IBM notified HCPF that it was impacted by exploitation of the recent MOVEit vulnerability, CVE-2023-34362, and the vendor utilizes the application to “move HCPF data files in the normal course of business.” On June 13, 2023, it was identified that HCPF files, specifically files that contained Health First Colorado and CHP+ members’ information, on IBM’s MOVEit application were accessed by an unauthorized actor around May 28, 2023. The sample of the data breach notification detailed the following information was exposed to the unauthorized actor: “full name, Social Security number, Medicaid ID number, Medicare ID number, date of birth, home address and other contact information, demographic or income information, clinical and medical information (such as diagnosis/condition, lab results, medication, or other treatment information), and health insurance information.” HCPF is not the only state organization in Colorado to be affected by a large-scale data breach in August 2023, as the Department of Higher Education (CDHE) disclosed a data breach on August 4, 2023, that exposed data spanning sixteen (16) years. CTIX analysts will continue to monitor campaigns impacting Colorado organizations and provide updates on the state’s latest data breaches as needed.