DC Health Link breach exposes data on 56,000 people including members of Congress

DC Health Link, the health insurance marketplace run by the District of Columbia, disclosed in early March 2023 that customer data had been stolen and offered for sale on a hacking forum. The marketplace said it learned of the breach on March 6, 2023 and brought in the FBI and the incident response firm Mandiant the same day.

The exchange put the number of affected current and former customers at 56,415. Because DC Health Link administers coverage for congressional offices as well as District residents and small businesses, the victims included members of Congress, their families and Capitol Hill staff. The House Chief Administrative Officer notified members on March 8, and the Senate Sergeant at Arms alerted Senate staff.

Reporting at the time described exposed data including names, Social Security numbers, dates of birth, home addresses, phone numbers, email addresses, health plan details, ethnicity and citizenship status. A threat actor claimed on a forum to hold records on about 170,000 customers, a figure the exchange did not confirm.

DC Health Link offered three years of identity and credit monitoring to all customers, not only those confirmed affected, and said it had commissioned a third-party investigation. House leaders including Speaker Kevin McCarthy and Minority Leader Hakeem Jeffries pressed the exchange for details, and House Administration ranking member Joseph Morelle called the exposure a serious risk to members, employees and their families. A later review attributed the breach to a misconfigured server that let the stolen reports be pulled without authentication.