Delta Dental of California covers about 45 million people across 15 states. Between May 27 and May 30, 2023, attackers took data on 6,928,932 of its members without ever logging in. They came through MOVEit Transfer, a file-sharing application the company used to exchange files with partners. The flaw they used had no patch because nobody outside the attackers knew it existed.
The Delta Dental data breach is a clean example of a risk every insurer carries. A third-party application sitting on the internet can hand over your data even when your own code has no flaw at all. This teardown walks the timeline, the attack chain and what a team can still control when the entry point is a zero-day.
What CodeAnt AI solves here: CodeAnt AI continuously maps every internet-facing application you run, including third-party software like file transfer servers, and tests it the way an attacker would. When a new advisory lands, you already know where the affected software lives and what it can reach.
What Happened in the Delta Dental Data Breach
The dates below come from Delta Dental's own breach notice, its filing with the Maine attorney general and reporting by BleepingComputer and The HIPAA Journal.
Date | What happened |
|---|---|
May 27 to 30, 2023 | Attackers access and take files from Delta Dental's MOVEit Transfer platform. |
May 31, 2023 | Progress Software discloses a critical vulnerability in MOVEit Transfer. |
June 1, 2023 | Delta Dental learns its MOVEit instance was exploited. |
July 6, 2023 | The investigation confirms data was accessed and acquired without authorization. |
September 6, 2023 | Delta Dental reports the breach to HHS with a placeholder count of 501 people. |
November 27, 2023 | The forensic review of exactly whose data was taken is complete. |
December 14, 2023 | Delta Dental files its notice with the Maine attorney general, listing 6,928,932 people. |
The theft was over before the vulnerability was public. Patching speed could not have changed the outcome for Delta Dental.
What Data Was Exposed
The exposed fields varied by person. Delta Dental said the stolen files included information shared in connection with dental procedures and claims payments.
Identity data: Names, addresses, Social Security numbers, driver's license, passport and state ID numbers, and tax identification numbers.
Financial data: Financial account numbers and credit or debit card numbers, in some cases with security codes.
Health data: Health insurance policy numbers and health information.
That mix of identity, payment and health data is why insurance files are worth stealing in bulk. One record carries enough to open accounts, commit medical fraud and run targeted phishing.
The Attack Chain, Technically
The MOVEit campaign did not target Delta Dental specifically. The group behind it, Cl0p, hit thousands of organizations running the same software in the same few days.
Stage 1. An internet-facing file transfer server
MOVEit Transfer exists to exchange files with outside parties. That job requires it to be reachable from the internet, usually with a web interface anyone can load. Every organization running it had the same front door open. The attackers only needed a way to walk through it without credentials.
Stage 2. SQL injection in the web front end
The flaw, tracked as CVE-2023-34362, was a SQL injection in MOVEit Transfer's web application. An unauthenticated attacker could use it to reach the application's database and run code on the server. No login was involved at any point. Credential-based controls like MFA never came into play.
Stage 3. A web shell for durable access
According to the joint CISA and FBI advisory on the campaign, Cl0p installed a web shell called LEMURLOOT, disguised as a file named human2.aspx. The web shell let the attackers list stored files, pull cloud storage settings and create new administrative accounts. From that point, they could come and go through a page that looked like part of the application.
Stage 4. Bulk theft of files sitting on the server
The attackers then downloaded what was stored on the platform. A file transfer server is often treated as a pipe, and in practice it becomes a warehouse full of files nobody deleted after they were delivered. Everything retained on the server was in scope. Anything cleaned up after delivery would not have been.
Stage 5. Mass exploitation on a holiday weekend
The exploitation window ran across the US Memorial Day weekend. Cl0p picked the days when the people who read security alerts were least likely to be reading them. Delta Dental was one of thousands of victims. Among healthcare organizations, it was the third-largest MOVEit breach reported, behind Maximus and Welltok.
Why File Transfer Servers Keep Getting Breached
MOVEit was the fourth time the same group went after the same category of software. Each campaign followed the same pattern of a zero-day in an internet-facing managed file transfer product, then mass data theft.
Year | Product | Group | Entry point |
|---|---|---|---|
2020 to 2021 | Accellion File Transfer Appliance | Cl0p | Zero-day vulnerabilities in the appliance |
2023 | Fortra GoAnywhere MFT | Cl0p | Remote code execution flaw, CVE-2023-0669 |
2023 | Progress MOVEit Transfer | Cl0p | SQL injection, CVE-2023-34362 |
2024 | Cleo file transfer products | Cl0p | File upload and execution flaws, including CVE-2024-50623 |
These products concentrate sensitive files from many partners in one internet-facing place. For an extortion group, that is the most efficient target available.
What a Zero-Day Leaves in Your Control
Delta Dental could not have patched a flaw nobody had disclosed. Several controls still decide how bad a zero-day gets.
Retention on the transfer server: Files that auto-delete after pickup cannot be stolen later. Retention settings set the size of the breach before any attacker arrives.
Exposure of the web interface: Restricting the portal to known partner IP ranges shrinks the population of attackers who can reach it.
Web root integrity monitoring: A new .aspx file appearing in an application directory is an alert worth waking someone for.
Egress monitoring: Large outbound transfers from a file server at unusual hours are detectable even when the entry point is not.
Knowing what you run: When Progress published its advisory, every hour spent finding MOVEit instances was an hour of continued exposure.
Delta Dental's own notice lists the steps it took afterward. It stopped access, removed malicious files, applied patches, reset administrative passwords and increased monitoring on the platform.
What a Real Test Against This Chain Looks Like
A pentest will not reliably find a zero-day nobody has discovered. What it can do is shrink what that zero-day reaches and cut the time to respond when the next advisory drops.
Chain link | What the test checks | Evidence it produces |
|---|---|---|
Unknown third-party software | Every internet-facing application, fingerprinted by product and version | An inventory you can search the day an advisory lands |
Web front end | Unauthenticated injection and file upload testing on exposed interfaces | Proof of any exploitable input path |
Stored data | What files the platform holds and for how long | The data an attacker would get today |
Server reach | What the application's service account and stored cloud keys can access | The path from one compromised server to other systems |
Detection | Whether new files in the web root or bulk downloads trigger alerts | Time to detect, or proof that nothing fired |
The API penetration testing guide covers how the same injection and authorization tests apply to the APIs behind partner integrations.
Lessons for Dental, Health and Insurance Teams
The Delta Dental data breach carries a few lessons that apply to any plan exchanging files with brokers, employers and providers.
Treat vendor software as your attack surface: You did not write MOVEit, and your members' data was still on it.
Keep a live inventory: Know every third-party application exposed to the internet, with version numbers, before the next advisory.
Shorten retention on transfer platforms: A file transfer server should hold files for as long as delivery takes.
Plan for mass exploitation: When a flaw hits thousands of organizations at once, vendor support and incident responders are stretched thin. Have your response plan written already.
Map the regulatory clock: A breach involving member health data triggers HIPAA breach notification, and the HIPAA penetration testing requirements apply to how you evidence your controls.
The same vendor-path risk shows up across the industry. Our guide to how insurers get breached through portals, APIs and vendors covers the other doors, and how healthcare data breaches happen covers the patterns on the provider side.
How CodeAnt Would Have Caught This
No testing tool can promise to find a vendor's zero-day before the attacker does, and we won't claim CodeAnt would have prevented this breach. What CodeAnt changes is the ground the zero-day lands on.
Continuous attack surface management: CodeAnt maps every domain, open port and exposed service from more than thirty data sources, and fingerprints the technology behind each. A MOVEit instance shows up with its version, and so does the next file transfer product.
Known-exploited vulnerability matching: Exposed services are checked against the National Vulnerability Database and the CISA Known Exploited Vulnerabilities catalog, so a new advisory maps to your assets quickly.
Testing what the server can reach: Agents test the exposed application and chain what a foothold on it can touch, including stored cloud credentials, with a working proof of exploit for each high or critical finding.
Evidence for the file: Findings come with remediation guidance and retest results you can hand to auditors and your HIPAA risk analysis.
See the format in the walkthrough of how AI penetration testing traces a data leak.
The Fix
Delta Dental did not write the vulnerable code, and 6.9 million members' records were still taken from its platform. Third-party software on the internet is your attack surface whether or not your engineers built it. Know what you expose, limit what it stores and test what it can reach.
Run a free black box scan on one URL to see the third-party software your exposed surface is running. Then book a walkthrough to see how continuous testing keeps that inventory current.
