By Riley Griffin

Hackers stole millions of dollars in grant money from the Department of Health and Human Services last year in a series of attacks, according to two people familiar with the matter.

Between late March and mid-November, the hackers gained access to an HHS system that processes civilian grant payments and withdrew about $7.5 million intended to be awarded to five accounts, said the people, who asked not to be named as the details aren’t public.

“As federal stewards of the taxpayer dollar, we take this issue with the utmost importance,” an HHS spokesperson said in an emailed statement.

The hacks have left the intended recipients in limbo and investigators trying to track down the culprits, underscoring how vulnerable the US health system is to an increasing amount of phishing schemes and other cyber threats. In October, HHS’s Office of Information Security and the Health Sector Cybersecurity Coordination Center warned of the threat phishing poses to the health sector, which is a prime target for criminals seeking to capitalize on sensitive patient data.

A portion of the grant money, about $1.5 million, was supposed to be awarded by the Health Resources & Services Administration, which describes itself as providing care to the “nation’s highest-need communities.” No further details about the grant money or the recipients was immediately available.

Biden administration officials are frustrated over how long it took the incidents to be escalated, in part because they weren’t treated as “cybersecurity” incidents, the people said, adding that many individuals have been working aggressively to address the problem and ensure the grantees will be able to access the funds. The White House didn’t immediately respond to a request for comment.

HHS has notified other government stakeholders, including the FBI and the Department of Homeland Security, of the incidents, the people said. Other parts of the US government, including the Executive Office of the President and the US Agency for International Development also use the payment systems’ services.