DC’s Medicaid agency left hidden ID data on 399,086 people in public website reports

The District of Columbia’s Department of Health Care Finance told federal regulators that 399,086 people were affected after two reports on its public website carried hidden personal data. The reports were supposed to show only group statistics, such as enrollment counts, yet the records underneath them could be reached by anyone who knew where to look.

Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.

Subscribe to TLDR →

We may earn a commission if you sign up.

Nobody broke into the agency’s systems. The exposure was a publishing mistake, and it ran for years: the personal information may have been reachable from 2023 until July 2026, and the people affected are Medicaid and DC Healthcare Alliance enrollees from that stretch.

Two website reports that held more than they showed

The department’s own incident notice says it learned on July 21, 2026, that two reports on its website contained hidden personal information. In the notice’s words, “These reports were intended to display only summary information about groups of people,” while “underlying personal information that supported these reports may have been reachable” by unauthorized users. SecurityWeek, which reported the notification on Sept. 28, described the cause as a data exposure rather than a hack.

The department removed the two reports as soon as it found the problem, began an internal review and ran checks on its systems, according to the same account. Its notice also says it is strengthening internal processes to prevent a repeat, though it does not describe what the new process will be or who is responsible for checking files before they go online.

The fields that were exposed and the ones that were not

The data that may have been reachable includes Medicaid ID numbers, provider names and dates of birth, along with race, gender, ethnicity and ward. For a Medicaid recipient, the combination of a program ID, a birth date and the name of the doctor or clinic that treated them is the kind of detail a scammer can use to pose as a plan or a provider.

The department says Social Security numbers, beneficiary names and financial account information were not included. The sample notification letter repeats that Social Security numbers and financial account details were not part of the data, and it adds that the notice also covers information about children and deceased family members. That limits the usual route to identity theft, but it does not remove the risk of medical or benefits fraud built on a valid Medicaid number.

Health department guidance and steps for residents

The department says it “has no reason to believe anyone looked at or used any of this information in the wrong way.” That is a statement about what it has learned so far, and it sits next to a plain admission that unauthorized users may have been able to reach the data for roughly three years.

Its notice points recipients to the free annual credit reports from Equifax, Experian and TransUnion, suggests a free fraud alert, and says to review any mail about health coverage or services for errors. It also lists a toll-free line, 1-833-687-5424, for people who think they should have received a letter but did not. The notice does not mention a free credit-monitoring service.

The path from discovery to the federal breach list

The HIPAA Journal reported on Sept. 30 that the department judged the incident a reportable breach under federal health-privacy rules and notified the Department of Health and Human Services’ Office for Civil Rights on Sept. 3, 2026. That is just over six weeks after the July 21 discovery, with the two reports already removed from the website by then. Individual letters are being mailed to the people affected, and the department’s toll-free line is meant for anyone who believes a letter should have reached them but did not. The federal portal, which lists breaches affecting 500 or more people, added the case shortly before the HIPAA Journal and SecurityWeek stories ran.

Neither the notice nor the coverage says who first spotted the hidden data, or how many times the two reports were actually downloaded during the roughly three years they were up. Those two answers decide whether the department’s statement that it has no reason to believe misuse occurred rests on log evidence or on the absence of complaints. The notice does not say which.

The filing landed on the federal government’s public HHS breach portal, which lists incidents affecting 500 or more people, in the week before SecurityWeek’s story. It arrived amid other health-sector disclosures: SecurityWeek separately reported on Sept. 24 that California-based Astrana Health had told the Securities and Exchange Commission about an incident in which attackers took private and confidential information after impersonating staff by phone. Astrana has not said how many people are involved, so the D.C. figure of 399,086 is, for now, the better-documented number.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

Tech news in one quick read: Subscribe to TLDR →

We may earn a commission if you sign up.