Cyber Incident Victim: Health Insurance Marketplace
Date:
Nov 2018
Location:
United States of America
Summary
An employee at a CMS contact center improperly accessed a Healthcare.gov database, stealing personal data from over 8,000 individuals. The perpetrator conducted unauthorized bulk searches, exfiltrated information via email, and exploited stolen details to fraudulently obtain credit cards and loans. The incident resulted in substantial financial losses exceeding $500,000 for affected organizations, covering incident response, victim notifications, and protective measures. Following federal charges, the individual received a 42-month prison sentence with supervised release and financial penalties.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In November 2018, Colbi Trent Defiore, a 27-year-old seasonal employee at a Virginia-based technology company operating contact centers for the Centers for Medicare & Medicaid Services (CMS), engaged in unauthorized access of Healthcare.gov consumer data. Defiore, stationed at a call center in Bogalusa, Louisiana, exploited his position to conduct bulk searches within the Healthcare.gov database—an action explicitly prohibited by his employer—despite having received training on proper handling of personally identifiable information (PII). He extracted data belonging to over 8,000 individuals by copying search results to a clipboard and emailing them to his work email account. After his shifts ended, Defiore remotely accessed his work email without authorization to retrieve the stolen PII. Over multiple occasions during that month, he systematically harvested sensitive consumer details, which he later used to commit financial fraud.
Defiore fraudulently applied for at least six credit cards, personal loans, and lines of credit using the stolen information of five confirmed victims, seeking personal financial gain. The breach was investigated by federal authorities, leading to Defiore’s indictment by a grand jury on November 7, 2019, on charges of intentionally accessing a protected computer exceeding authorized access for financial benefit and in furtherance of a felony. The incident caused $587,000 in losses to the call center operators, covering costs for incident response, damage assessments, system remediation, victim notifications, and identity theft protection services for affected consumers. In December 2020, Defiore was sentenced to 42 months in federal prison followed by three years of supervised release and ordered to pay a $100 special assessment fee. The case underscored vulnerabilities in contractor oversight within federal healthcare enrollment systems but did not implicate technical flaws in Healthcare.gov’s infrastructure itself.