DC Health Agency Reports Potential Exposure of Nearly 400,000 Beneficiary Records
Summary
Two DHCF website reports may have exposed personal information for 399,086 Medicaid and DC Healthcare Alliance beneficiaries. The agency says it has no reason to believe anyone accessed or misused the data.
Key points
- DHCF said two reports on its website contained hidden personal information that may have been accessible to unauthorized users from 2023 until the agency discovered the issue in July 2026.
- The affected population includes Medicaid and DC Healthcare Alliance beneficiaries enrolled between 2023 and 2026; DHCF reported 399,086 affected people to HHS.
- Potentially exposed data included Medicaid IDs, provider names, dates of birth, race, gender, ethnicity, and ward.
- DHCF said Social Security numbers, names, and financial information were not compromised.
- The agency said it has no reason to believe anyone accessed or misused the information, but advised affected people to stay alert for identity theft and fraud.
- DHCF removed the reports, began an internal review, and conducted internal system checks.
Article Details
- Victim Organization
- District of Columbia Department of Health Care Finance (DHCF)
- Incident Type
- Exposure of personal information through two reports on the agency's website; the agency stated the incident was not caused by hacking.
- Data Types Exposed
- Medicaid IDs
- Provider names
- Dates of birth
- Race
- Gender
- Ethnicity
- Ward
- Affected Records
- 399,086 people, according to information DHCF provided to HHS.
- Operational Impact
- DHCF removed the reports after discovering the exposure, initiated an internal review, and performed internal system checks. The agency said it had no reason to believe anyone accessed or misused the information.
- Claim Status
- confirmed