A data breach at a health insurance exchange in Washington, D.C. has led a hacker to steal the personal information of US lawmakers and their staff.
The breach hit DC Health link, which also administers healthcare plans for members of Congress. Catherine Szpindor, the Chief Administrative Officer for the House of Representatives, notified lawmakers and their staff members about the incident on Wednesday.
“Currently, I do not know the size and scope of the breach, but have been informed by the Federal Bureau of Investigation (FBI) that account information and PII (personal identifying information) of hundreds of Member and House staff were stolen,” Szpindor wrote, according to The Daily Caller, which was first to report the news.
NBC News adds that the breach also ensnared members of the US Senate, citing an email sent to Senate offices.
A hacker who goes by the name “IntelBroker” has claimed responsibility for the breach. On Monday, the attacker began taking bids for the stolen data in a forum, saying it contained the personal information of 170,000 individuals, including their Social Security numbers, dates of birth, email addresses, and home addresses.
The forum has since banned IntelBroker. However, another user is circulating a copy of what appears to be the same database on the open web.
DC Health Link has confirmed the stolen data was publicly exposed on the forum. “We have initiated a comprehensive investigation and are working with forensic investigators and law enforcement,” the insurance exchange told PCMag. “Concurrently, we are taking action to ensure the security and privacy of our users’ personal information.”
The exposed information could make it easy to conduct identity theft schemes on any of the individuals in the stolen database. In addition, hackers could exploit the data to try to deliver phishing messages to the personal email addresses of lawmakers and their staff, which could put national security in jeopardy.
In response, DC Health Link says it’ll provide free identity and credit monitoring services to all its customers. "The investigation is still ongoing and we will provide more information as we have more to share," it added.