District of Columbia Department of Health Care Finance (DHCF) public notice (page dhcf-data-incident) states that on 21 July 2026 DHCF learned two reports on its website contained hidden personal information reachable by unauthorised users.

Reports were meant to show only aggregate enrollment/statistics; underlying PII supporting those reports may have been reachable between 2023 and July 2026. Exposed fields may have included Medicaid ID numbers, date of birth, provider name, race, gender, ward, or ethnicity; DHCF says beneficiary names, Social Security numbers, and financial account information were not included.

Not a hacking incident — misconfigured public reports. DHCF removed the reports immediately, began an internal review, and is mailing individual notices; enrollees in Medicaid or DC Healthcare Alliance between 2023 and July 2026 may call 1-833-687-5424.

DHCF says it has no reason to believe the data was misused. Primary: DHCF notice. Updated 30 Sep 2026: The HIPAA Journal reports that the investigation determined the personal and protected health information of 399,086 Medicaid and DC Healthcare Alliance beneficiaries may have been accessed by unauthorised individuals. (source: The HIPAA Journal)