Between 2023 and July 2026, two reports on the District of Columbia Department of Health Care Finance website inadvertently exposed underlying personal information of approximately 399,086 Medicaid and DC Healthcare Alliance beneficiaries. The reports were designed to show only summary statistics but contained accessible hidden data including Medicaid IDs, provider names, dates of birth, race, gender, ethnicity, and ward. No Social Security numbers, names, or financial data were exposed. The exposure was discovered internally and was not the result of hacking. DHCF promptly removed the reports, conducted internal reviews, and notified affected individuals and regulatory authorities.

The exposure potentially compromised sensitive beneficiary information such as Medicaid IDs and demographic details for nearly 400,000 individuals. Although Social Security numbers and financial information were not exposed, the data could still pose a risk for identity theft or fraud attempts. DHCF has no indication that the information was accessed or misused by unauthorized parties. The breach affects privacy and confidentiality of beneficiary data but does not appear to involve direct financial loss or identity theft at this time.

DHCF removed the vulnerable reports from its website immediately upon discovery of the exposure and conducted internal system checks and reviews. Affected individuals have been notified and advised to remain vigilant against identity theft and fraud. There is no indication that further action is required at this time. Organizations should ensure that reports or data published on public-facing websites do not contain hidden or underlying personal information accessible to unauthorized users.