Nearly 400,000 DC Medicaid beneficiaries’ data exposed on public website

Nearly 400,000 District of Columbia Medicaid and DC Healthcare Alliance beneficiaries may have had their personal data exposed through reports published on a public website. The incident, which affects individuals enrolled between 2023 and 2026, was not caused by a cyberattack, according to a recent report by Security Affairs.

The District of Columbia Department of Health Care Finance (DHCF) discovered in July that two reports on its website contained hidden personal information accessible to unauthorized individuals. The exposed data, which supported summary statistics and enrollment counts, may have included Medicaid IDs, dates of birth, provider names, race, gender, ward, and ethnicity. Names, Social Security numbers and financial information were not included, which DHCF states lowers the risk of misuse.

The agency has removed the affected reports, launched an internal review, and is strengthening its processes. While there is no evidence the data was accessed or misused, beneficiaries are advised to remain vigilant against identity theft and monitor their accounts and credit reports. Affected individuals are entitled to free credit reports and can place a fraud alert on their credit files.

Source: Security Affairs