Hackers: We stole health records from the House and Senate

DC Health Link confirmed data from an unspecified number of customers was affected and said it was notifying them and working with law enforcement. It said it offers identity theft services to those affected and extends credit monitoring to all customers.

The FBI said it was aware of the incident and was helping the investigation.

A broker on an online crime forum claimed to have records of 170,000 DC Health Link customers and was putting them up for sale for an unspecified amount. The agent claimed they were stolen on Monday. The broker, reached by The Associated Press on an encrypted chat site, did not say whether the data was purchased and said it could not provide any additional data to support the claim. They said they were acting on behalf of the seller, whom they identified as “thekilob.”

Exemplary stolen data was published on the website for a dozen apparent customers. It contained social security numbers, addresses, employer names, phone numbers, email, and addresses. The AP reached one of the dozen by dialing a number listed.

“Oh my god,” the man said when informed the information was public. All 12 people listed work for the same company or are family members.

In an email to all Senate email account holders, the Sergeant at Arms said he had been informed that the stolen data included the full names of policyholders and family members. An email sent by the Office of the House Chief Administrative Office on behalf of Representative Kevin McCarthy and Minority Leader Hakeem Jeffries called the breach “egregious” and vowed to provide updates. It urged members to use resources to monitor credit and identity theft.

The Senate email recommended anyone registered with the health insurance exchange freeze their balances to prevent identity theft.

In an emailed statement, Rep. Joe Morelle of New York said the House of Representatives leadership had been notified by Capitol Police that DC Health Link had “suffered an exceptionally large data breach of enrolled information,” the one posed a “great risk” to members, staff and their family members. “At this time, the cause, size and scope of the data breach affecting the DC Health Link have yet to be determined by the FBI,” Morelle said.

The hack follows several recent breaches affecting US authorities. Hackers broke into a US Marshals Service computer system on February 17 and activated ransomware after stealing personal information about agency officials and targets of investigations.

An FBI computer system was recently breached at the FBI’s New York field office, CNN reported in mid-February. When asked about this intrusion, the FBI issued a statement calling it “an isolated incident that has been contained.” It declined further comment, including when it occurred and whether ransomware was involved.

There was no indication that the integrity breach was ransomware-related.