Loading story…
The District of Columbia Department of Health Care Finance (DHCF) disclosed that two publicly accessible web reports exposed underlying personal data for 399,086 DC Medicaid and DC Healthcare Alliance beneficiaries enrolled from 2023 to 2026. Although the reports displayed aggregate enrollment and statistical information, hidden data may have been available to unauthorized visitors from 2023 until the agency identified the issue on July 21, 2026.
The exposed fields included Medicaid IDs, dates of birth, provider names, race, gender, ethnicity, and ward; the agency said names, Social Security numbers, and financial-account information were not included. DHCF said the incident was not a cyberattack and that it has found no evidence of access or misuse, but removed the reports, began an internal review and system checks, notified affected individuals, and reported the exposure to the US Department of Health and Human Services.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
The US Department of Health and Human Services added DHCF to its data-breach portal for the exposure affecting 399,086 individuals.
DHCF discovered on July 21 that two public reports exposed hidden personal information associated with 399,086 beneficiaries enrolled between 2023 and 2026. The agency said the incident was not caused by a cyberattack and found no evidence of access or misuse.
Two publicly accessible DHCF reports contained underlying personal information for DC Medicaid and DC Healthcare Alliance beneficiaries, potentially allowing unauthorized access beginning in 2023.
Following discovery, DHCF removed the affected reports, initiated an internal review and system checks, notified affected individuals, and reported the incident to the US Department of Health and Human Services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesecurityweek.com
Open sourceusa.gov
Open sourcedhcf.dc.gov
Open sourcedhcf.dc.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Illinois Department of Human Services (IDHS) exposed sensitive data of over 700,000 individuals after internal planning maps containing personal information were inadvertently made publicly accessible online. The incident was caused by misconfigured privacy settings on a mapping website used for resource allocation and decision-making, allowing unauthorized access to data from as early as 2021 until September 2025. The exposed information included addresses, case numbers, demographic details, and medical assistance plan names for Medicaid and Medicare Savings Program recipients, as well as names and case details for Division of Rehabilitation Services (DRS) customers. Upon discovery of the breach in September 2025, IDHS immediately secured the website and launched an investigation to assess the scope and cause of the exposure. The agency confirmed that approximately 672,616 Medicaid and Medicare Savings Program recipients and 32,401 DRS customers were affected. In response, IDHS updated the privacy settings to restrict access to authorized personnel and began notifying impacted individuals about the incident.
Jun 29, 2026
DC Health Link and Doxbin were added as sensitive breach incidents after large datasets containing personal information were exposed online. DC Health Link disclosed a breach discovered in March 2023 after data was reportedly posted to a well-known breach forum, exposing about **48,000 unique email addresses** alongside names, genders, dates of birth, home addresses, phone numbers, and **Social Security numbers**; the posting was linked in reporting to **`IntelBroker`**. Doxbin, a doxing website, was also listed for a breach affecting more than **370,000 unique email addresses** after data from January 2022 leaked. The exposed records included account details such as usernames, password hashes, and browser user agents, as well as highly sensitive victim information contained in doxes, including names, physical addresses, and phone numbers. Both incidents were classified as **sensitive**, meaning the compromised data is not publicly searchable through the breach-notification service.
Jun 29, 2026
Unauthorized users exploited a vulnerability in the Defense Manpower Data Center's file-sharing system, accessing unencrypted personnel files from about October 2025 until the flaw was detected on July 16, 2026. The breach may affect roughly 4 million current and former Department of Defense personnel. Exposed information reportedly includes names, dates of birth, contact and demographic data, unencrypted Social Security numbers, and in some cases military occupational specialty or equivalent role codes. DMDC remediated the vulnerability and restored the affected system, detecting and containing the intrusion in July before notifying individuals on September 18. It offered 12 months of IDX credit-monitoring and identity-restoration services; no malicious use had been reported at publication. The incident has not been attributed, and the exploited vulnerability has not been disclosed, but the combination of identity data and military-role information creates substantial identity-fraud and counterintelligence risk, potentially enabling adversaries to identify and target service members, veterans, and their families.
Sep 28, 2026