Washington, D.C.’s Medicaid agency left hidden personal data on 399,086 people in public reports

Washington, D.C.’s Department of Health Care Finance told federal regulators that 399,086 people were affected after two reports on its website carried hidden personal data. The agency says it learned of the problem on July 21, 2026, and that the underlying information may have been reachable by unauthorized users between 2023 and July 2026. Nothing in the agency’s account describes a hack, and the agency says it has no reason to believe anyone misused the information.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The people affected were enrolled in Medicaid or the D.C. Healthcare Alliance during those years. The exposure came from reports built to display summary numbers, which makes it a different kind of failure from a break-in: the data was sitting inside pages the agency itself published. The exposure window of 2023 to July 2026 covers about three years of enrollment, and the notice says individuals enrolled at any point in that span may be among those affected, including a child or a deceased family member whose information appears in a relative’s record.

Two reports built to show only summary statistics

In its public incident notice, the agency says two website reports “contained hidden personal information that could be accessed by people who did not have permission.” They were meant to show only statistics such as enrollment counts, and on the screen they did not show anyone’s personal details. The department removed both reports once it found the problem, began an internal review and ran checks on its internal systems. SecurityWeek, which reported on the filing on Sept. 28, says the agency stresses that this was not a hacking incident: the personal data was reachable through its own website reports. The agency’s notice states that the underlying data may have been reachable by unauthorized users between 2023 and July 2026, which is the period the exposure covers.

The agency has not named the reports. HIPAA Journal describes the underlying records as sitting in hidden fields that could potentially be accessed by unauthorized individuals, which fits the agency’s wording that the personal data was present but not displayed.

The Medicaid IDs and birth dates involved

According to DHCF’s notice and its sample notification letter, the hidden data may have included Medicaid ID numbers, dates of birth, provider names, race, gender, ward and ethnicity. The agency says the information did not include beneficiary names, Social Security numbers or financial account information. The letter says the information may also relate to a child or a deceased family member of the person receiving it.

Notification letters cited by SecurityWeek say misuse is “less likely” because no Social Security numbers or financial account details were involved. The agency also says it has no reason to believe anyone looked at or used the information improperly, a statement that describes what the agency has found, not proof that no one saw the data across a window of roughly three years. A Medicaid ID paired with a date of birth, provider name and ward is still identifying health-program information, which is why the agency tells recipients to watch their credit reports and the mail about their coverage.

The HHS filing and what the letters tell recipients

HIPAA Journal reports that DHCF notified the Office for Civil Rights at the Department of Health and Human Services on Sept. 3, 2026, and that the breach appeared on the office’s public breach portal shortly before its own report on Sept. 30. SecurityWeek covered the filing on Sept. 28, with the 399,086 figure drawn from what the agency reported to HHS. Individual letters are being mailed, including on behalf of children and family members. The sample letter on the agency’s site carries a placeholder where the notice date would go, so the mailing date is not shown in the document itself, and the agency states that it is also notifying the Office for Civil Rights.

The sample letter offers no credit monitoring or other paid service. It points recipients to free credit reports at annualcreditreport.com from Equifax, Experian and TransUnion, to a free fraud alert, and to a review of any mail about their health coverage for accuracy. The agency’s incident page adds the option of a security freeze and says suspected identity theft can be reported to law enforcement, the D.C. Attorney General or the Federal Trade Commission. The letter also tells recipients to contact the credit company right away about any account they did not open. People who believe they should have received a letter but did not can call the department’s toll-free line at 1-833-687-5424.

HIPAA Journal’s report on the breach does not mention lawsuits, and none appear in the other coverage reviewed. What remains unanswered is how long the reports were live before July 21, who might have retrieved the hidden fields, and what process change will keep a summary report from carrying row-level data again; the agency says only that it is strengthening internal processes. SecurityWeek says the agency told HHS the 399,086 figure, and the incident page itself gives no count, so the number rests on the federal filing.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.