An official with the Department of Health and Human Services said attackers gained access to data by exploiting a major vulnerability found in the popular MOVEit file transfer service.
Article Link: Third-party contractor software exploited in attack on HHS data - Nextgov