17 House Members, Hundreds of Staffers Affected by DC Health Data Breach

The DC Health Link data breach, first reported on March 8th by The Epoch Times, affected at least 17 House members as well as hundreds of congressional staffers. A spokesperson for the House Committee on House Administration confirmed that the incident was reported to The Epoch Times on March 15.

DC Health Link, run by Washington’s Health Benefit Exchange Authority is the district’s insurance marketplace. The names of the affected members of Congress have not been disclosed. They were among 56,415 total enrolled persons whose personal identifiable information was exposed in a public forum.

“Last week, it was discovered that a breach of data from DC Health Link included the personal identifiable information (PII) of several members, senators, staff, and their families,” In a statement dated March 14, Bryan Steil (Republican from Wisconsin), who is the chairman of Committee on House Administration, noted this. “Immediately after learning of the breach, congressional leadership responded with a strong, nonpartisan response to ensure accountability and security. As a result, the DC Health Benefit Exchange Authority will provide credit monitoring to all members.”

Steil said that the investigation is ongoing and that U.S Capitol Police, House Sergeant of Arms, and chief administrative office are all working together to help those affected.

“I’m committed to protecting this institution,” He continued. “Moving forward, the Committee on House Administration will take action to hold bad actors accountable and avoid this occurring again in the future.”

DC Health Link states that the DC Health Exchange Authority received notification of the breach on March 6th. After this, an investigation was started in coordination between law enforcement officials and a third party forensics company.

Sensitive information included the name of the enrollee, Social Security number and date of birth, gender address, email, number, race, ethnicity status, health plan information, employer information, as well as employer information. But not all of these fields were compromised for each individual.

The Epoch Times also reached out to the Senate Committee on Rules and Administration in order to confirm the number affected senators by the breach.

Two groups affected

DC Health Link updated its website on March 14 to say that it has identified two groups of victims.

This first group consisted of those whose information was publicly posted and who were suspected to have been compromised. The second group contained individuals whose information was kept in the same way that the first group but investigators didn’t find evidence of their data being accessed or downloaded.

According to the exchange, data reviews were expected to be completed in the coming days.

“The issue which led to this data breach has been identified and eliminated. DC Health Link is working with third-party forensic experts to conduct a comprehensive review and to strengthen our security defenses.”

Adam Hudson, the public information officer at DC Health Benefit Exchange Authority, wrote this in an email sent to The Epoch Times on March 15. “We recognize the seriousness of this incident and we have reached out to impacted enrollees to provide three years of free identity and credit monitoring for all three major credit bureaus. The three years of monitoring protection includes all enrolled dependents, spouses and children. In addition, and out of an abundance of caution, we are offering the same three years of monitoring to all other customers, who were not impacted.

“While the investigation continues, our services are operating normally. However, we remain in a state heightened alert.”