DC Health Agency Exposes 400,000 Beneficiary Records
Source SecurityWeek
Description
The District of Columbia Department of Health Care Finance (DHCF) experienced a data exposure affecting nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries enrolled between 2023 and 2026. The exposure was due to two reports on the DHCF website that contained hidden personal information accessible to unauthorized users. The exposed data included Medicaid IDs, provider names, dates of birth, race, gender, ethnicity, and ward, but did not include Social Security numbers, names, or financial information. The breach was not caused by hacking but by unintended data exposure. DHCF removed the reports upon discovery in July 2026 and notified affected individuals and the US Department of Health and Human Services. The agency has no evidence that the information was misused but advises vigilance against identity theft and fraud.