THE District of Columbia Department of Health Care Finance (DHCF) is notifying 399,086 Medicaid and DC Healthcare Alliance beneficiaries that their personal information may have been exposed. The affected people enrolled between 2023 and 2026. DHCF said the incident was not caused by hacking: in July, it discovered that two reports on its website contained hidden personal information that unauthorised users may have been able to access between 2023 and July 2026.
The reports were designed to show only summary statistics, such as enrolment totals, and did not display personal details on screen. However, the underlying data supporting them may have been reachable. The information included Medicaid IDs, provider names, dates of birth, race, gender, ethnicity and ward. DHCF said names, Social Security numbers and financial information were not exposed.
The agency told the US Department of Health and Human Services about the incident, removed the reports immediately after discovering the problem, began an internal review and carried out system checks.
DHCF said it has no reason to believe anyone accessed or misused the information, while acknowledging that unauthorised access was possible. It advised potentially affected people to remain alert for identity theft and fraud attempts.