Breaches and incidents
District of Columbia Department of Health Care Finance: hidden personal data in public website reports exposed 399,086 Medicaid and Alliance beneficiaries
DHCF’s notice says that on 21 Jul 2026 it learned two reports on its website “contained hidden personal information”.
- Disclosed
- Verification
- Checked against a primary source
What happened
- DHCF’s notice says that on 21 Jul 2026 it learned two reports on its website “contained hidden personal information”; data that “may have been reachable by unauthorized users between 2023 and July 2026” included Medicaid IDs, dates of birth, provider names, race, gender, ward and ethnicity, but not names, SSNs or financial data. SecurityWeek (28 Sep 2026) reports DHCF told HHS 399,086 people were affected.
- Root cause: per HIPAA Journal, the underlying personal data supporting summary reports “was contained in hidden fields”; SecurityWeek says it was not the result of hacking.
- No attacker; DHCF says it has “no reason to believe anyone looked at or used” the data.
- DHCF removed the reports, is mailing notices and is strengthening internal processes.