MOVEit application update

New York State Workers' Compensation Board sent this bulletin at 08/31/2023 12:00 PM EDT

MOVEit application update

In June 2023, the Workers’ Compensation Board (Board) issued a notice to users informing them that the Board’s MOVEit browser-based HTTPS file transfer platform at https://edi.wcb.ny.gov was temporarily unavailable due to a worldwide security vulnerability. After rigorous consultation with Progress MOVEIt engineers, the Board is implementing a MOVEit upgrade that meets all current security requirements.

Action required

The Board’s updated MOVEit platform is set to go live in early October. In preparation, the Board has created new user accounts utilizing your current username; however, you will be required to set a new password. While the application will allow you to re-use your previous password, it is highly recommended you create a new, distinct password to ensure your account is properly secured. We have set up a temporary platform for password setting, which is available now. To set your new password, please see the relevant instructions below. If your organization has a shared username, only one user should reset the password and share the updated password within your organization accordingly.

Web File Transfer users

  1. Open your web browser and navigate to https://edi-temp.wcb.ny.gov.  
  2. Select Forgot Password?  
  3. Enter the username you use in the current MOVEit application in the Username field and select Continue. This will cause the new MOVEit application to email your registered email address.   
  4. Within 60 minutes of completing step 3, go into your email application, look for an email from moveit_noreply@wcb.ny.gov, and follow the link in the email. Important: The password created in this step will not be used until the new MOVEit application goes live in early October. Continue to use your pre-existing username/password to access WinSCP to download your files.  
  5. Once the updated MOVEit application goes live, you can access it via https://edi.wcb.ny.gov using the new password created in the preceding steps.  
  6. If your organization uses a shared username, share the newly created password with personnel as appropriate. 

Web users should continue to log in to WinSCP using your current username and password to retrieve digital notices until our updated MOVEit platform is available in early October. The Board will issue another notification when you can begin retrieving digital notices from the updated, secure MOVEit application.

Web users can contact WCBCustomerSupport@wcb.ny.gov with any questions.

sFTP File Transfer users

The worldwide MOVEit security vulnerability does not impact organizations that employ automated scripting to connect to our MOVEit-managed sFTP servers to drop and pull files. The security vulnerability is limited to HTTPS web users only. However, if you are a sFTP File Transfer user, you must also update your password for a successful migration to the Board’s MOVEit upgrade as indicated below.

  1. Open your web browser and navigate to https://edi-temp.wcb.ny.gov.  
  2. Select Forgot Password? 
  3. Enter the username you use in the current MOVEit application in the Username field and select Continue. This will cause the new MOVEit application to email your registered email address. 
  4. Within 60 minutes of completing step 3, go into your email application, look for an email from moveit_noreply@wcb.ny.gov, and follow the link in the email. Important: The password created in this step will not be used until the new MOVEit application goes live in early October. Continue to use your pre-existing username/password to access your sFTP downloads.
  5. If automated scripting processes are used to access https://edi.wcb.ny.gov, you may want to update those scripts with the password set in step 4 for use after the updated MOVEit application goes live.  
  6. Once the updated MOVEit application goes live, it can be accessed via https://edi.wcb.ny.gov using the new password created in the preceding steps.  
  7. If your organization uses a shared username, share the newly created password with personnel as needed. 

sFTP users can contact its.dl.ggc.svc.wcb.moveit@its.ny.gov with any questions or for assistance.   

Additional information

When the updated MOVEit application goes live, it will be accessible via https://edi.wcb.ny.gov and its current IP address (161.11.225.206), not the temporary one you’ll be using to set your new password.

More information on the MOVEit application update will be provided in the weeks approaching the October cutover date. For further background on the MOVEit file exchange system, please visit https://www.wcb.ny.gov/filetransfer/.