Maximus

Maximus is a United States‑based organization that operates as a government contractor. Its headquarters are located in the United States of America. The company provides business process services, with a focus on health and human services programs. It manages applications and systems for state Medicaid agencies, as evidenced by its role as the administrator of an Ohio Medicaid provider application. In performing these services, Maximus routinely handles sensitive personal information, including Social Security numbers and protected health data. The firm’s work involves processing eligibility, enrollment, and claims‑related information for public benefit programs.

Because it handles protected health information and personally identifiable data, Maximus is subject to federal regulations such as HIPAA and state privacy statutes. Its position as a trusted steward of Medicaid data distinguishes it from contractors that work solely in non‑health sectors. The organization’s exposure to two notable cyber incidents highlights the volume and sensitivity of the data it oversees. In May 2021, unauthorized access to its Ohio Medicaid application potentially exposed the personal details of hundreds of thousands of providers. In May 2023, the Clop ransomware group’s exploitation of a zero‑day in Progress Software’s MOVEit transfer tool led to a breach that compromised Social Security numbers and health information of millions of individuals associated with Maximus. These incidents underscore the company’s scale of data responsibility and the regulatory environment in which it operates.