THE District of Columbia Department of Health Care Finance (DHCF) is notifying 399,086 Medicaid and DC Healthcare Alliance beneficiaries that their personal information may have been exposed through two reports published on its website. The affected people enrolled between 2023 and 2026.
DHCF said the incident was not caused by a cyberattack: the reports were designed to show only aggregated information, such as enrolment figures and statistics, but underlying data supporting them may have been accessible to unauthorised users between 2023 and July 2026.
Potentially exposed information included Medicaid IDs, dates of birth, provider names, race, gender, ward and ethnicity. Names, Social Security numbers and financial information were not included, according to DHCF. The agency discovered the issue on 21 July 2026, removed the reports, began an internal investigation and carried out system checks while strengthening its processes. It reported the incident to the US Department of Health and Human Services.
DHCF said it has no evidence that anyone accessed or misused the information, although it advised affected people to remain alert for identity theft and fraud. US residents can obtain free annual credit reports from Equifax, Experian and TransUnion through AnnualCreditReport.com, and can place a free one-year fraud alert by contacting any one of the three credit reference agencies.