Congress health data breach creates huge risks

By: Lisa Mascaro
and Frank Rajak
Associated Press

WASHINGTON - House leaders say the impact of a hack of health insurance marketplace sued by members of Congress "could be extraordinary," exposing sensitive personal data of lawmakers, their employees and families.
..... DC Health Link, which runs the exchange, said an unspecified numbers of customers were affected and it was notifying them and working with law enforcement to quantify the damage. It service to those affected and extending credit monitoring to all customers.
..... Some 11,000 of the exchange's more than 100,000 participants work in the House and senate or are relatives.
..... In a letter to the exchange's director posted on Twitter, House Speaker Keven McCarthy and Minority Leader Hakeem Jeffies said the breach "significantly increase the risk that Members, staff and their families will experience identity theft, financial crimes, and physical threats."
..... They said the FBI had informed them it was able to purchase the stolen data on the dark web, where it was offered for sale for an unspecified amount Monday [03/06/2023] on a hacker forum popular with cybercriminals. The FBI said in a statement Wednesday [03/08/2023] it was aware of the incident and was assisting.
..... In the letter, McCarthy and Jeffies said "the individuals selling the information appear unaware of the high-level sensitivity of the confidential information in their possession, and its relation to Members of Congress" but that would change as media reports publicized the breach.
..... They said the FBI had not yet determined the extent of the breach but that thousands of House members, employees and their families have enrolled in health insurance through DC Health Link since 2014. "The size and scope of impacted house customers could be extraordinary."
..... It was not clear whether and how the FBI could guarantee that copies of the stolen data are not circulating in cybercrime underworld.
..... In the sale offer, a broker on the Online crime forum claimed to have records on 170,000 DC Health Link customers and said they were stolen Monday. [03/06/2023] Reached on Wednesday [03/08/2023] via encrypted chat, the broker claimed to be acting on behalf of a seller known as "thekilob."
..... By Thursday, [03/09/2023] the offer and sample stolen data posted to the forum had been removed. The data listed Social Security numbers, addresses, names of employers, phone numbers, emails and addresses for a dozen DC Link participants. The AP reached one by phone on Wednesday [03/08/2023] evening.
..... "Oh my God," the man said when informed the information was public,/ All 12 people listed work for the same company or are family members.
..... In an email to all Senate email account holders on Wednesday, [03/08/2023] the sergeant at arms recommended that all those registered on the health insurance exchange freeze their credit to prevent identity theft.
..... An email sent out by the Chief Administrative Office of the House on behalf of McCarthy and Jeffries called the breach "egregious" and urged members to sue credit and identity theft monitoring resources.
..... The hack follows several recent breaches affecting a U.S. Marshals Service computer system and activated ransomware February 17 [2023] after stealing personally identifiable data about agency employees and targets of investigations.

HOME