A data breach on the District of Columbia's health insurance exchange exposed personal data on members of Congress, their families and employees, according to media reports.
DC Health Link confirmed to the Associated Press that it had been hit by the breach, and did not specify the number of customers impacted. The exchange offers plans to people living in the city and many legislators are enrolled in coverage through the platform.
House leadership disclosed the breach to their colleagues in an email obtained by Politico. The email from Speaker Kevin McCarthy and Minority Leader Hakeem Jeffries said the breach "compromised the personal information of numerous House Members, spouses, dependents and employees in both parties,” but did not specify which members of Congress were impacted, according to the article.
The leaders said they reached out to DC Health Link for additional details and were being briefed by the Federal Bureau of Investigation. The FBI confirmed to CBS News that personal health information on House members and staff was stolen, but they did not appear to be primary targets.
“Right now, our top priority is protecting the safety and security of anyone in the Capitol Hill community affected by the cyber hack,” McCarthy and Jeffries wrote.
The AP reported that a broker posted on an online crime forum that they had records on 170,000 DC Health Link customers available for sale, and that the data was stolen on Monday. The AP connected with the broker through an encrypted chat site, and that person did not say whether they had purchased the data or provided additional evidence to back up their claims.
However, sample data from the breach on several DC Health Link customers was posted online for potential buyers, which included Social Security numbers, and the Associated Press did reach one of those affected by phone.
The Associated Press also noted that this hack is just the latest in a series of several on federal agencies.