DC Medicaid agency's public reports carried hidden records on 399,086 people behind enrollment counts

Nothing is reachable now. After taking the reports down, DHCF started an internal review and ran internal system checks ^[5]. The agency dates the exposure from 2023 to July 2026 but does not give a start month ^[8]. That puts the window somewhere between two years and seven months and three and a half years ^[10].

DHCF described the failure in two sentences. "These reports were intended to display only summary information about groups of people, such as enrollment counts and other statistics, and did not show anyone's personal details on the screen," the agency said in its incident notice ^[2]. "However, underlying personal information that supported these reports may have been reachable by unauthorized users between 2023 and July 2026," it added ^[8].

Anyone checking what those pages displayed would have seen counts and statistics ^[2]. The personal records were in the data that supported the reports ^[8]. The notice does not say how a visitor would have reached that data or whether the agency's access logs go back to 2023.

That gap limits what DHCF's assurance can prove. The agency says it "has no reason to believe anyone looked at or used any of this information in the wrong way," and still urges recipients to watch for identity theft and fraud ^[6]. By its account this was a publishing error at one agency, and no hacking was involved ^[1].

The letters to enrollees lay out the agency's reasoning on risk. "Because the information that could have been reached did not include Social Security numbers or financial account information, it is less likely that the information connected to you, your child, or your family member will be used in the wrong way," DHCF wrote ^[4].