The FBI has purchased personal data stolen from a Washington DC health insurance marketplace whose customers included thousands of members of Congress, their staffers and their families, after the information was put up for sale on a criminal website.
This comes after DC Health Link was hacked earlier this week, an insurance provider for the District of Columbia, the federal district of the US Capitol. It is administered by the district’s Health Benefit Exchange Authority.
The FBI is believed to have taken the step to protect the personal information of the marketplace’s estimated 11,000 congressional and affiliated users, and to prevent the data from being used for impersonation or spam.
By Thursday, in an Associated Press article The Washington Post said The offer and sample stolen data posted in the forum were removed. However, it is not known whether copies of the stolen data are floating around elsewhere.
In a letter to DC Health Link, House Speaker Kevin McCarthy and Minority Leader Hakeem Jefferies said the hacker appeared to be unaware that the stolen data included information on politicians and others serving in Congress.
Of the more than 100,000 participants in the exchange, 11,000 serve in the House and Senate or are relatives, the Associated Press reports.
In letters to DC Health Link, the congressional leaders say the FBI told them the agency was able to purchase data on the dark web, and it included addresses of spouses, dependent children, Social Security numbers and home addresses.
data breach news The news first came from the site The Daily Caller on Wednesday, Which has been quoted from a letter from the Chief Administrative Officer of the House.
The biggest concern with this breach was that it was not discovered until after the data was up for sale, said Thomas Richards, principal security advisor for the integrity group at Synopsys Software.
“This, unfortunately, points to a failure in both prevention and detection of such attacks. The sensitivity and type of data breach should prompt a thorough review of DC Health Link cyber security policies and procedures. Addressing the root cause of the breach Without knowing, it is difficult to provide specific remedial guidance to prevent such attacks. In a situation like this, a forensic investigation of the affected systems needs to be done to determine the scope of the breach and prevent any further data leakage. DCs can still be accessed inside the Health Link network, so any anomalous network connections or activity need to be reviewed.
The DC HealthLink data breach underscores how important it is for healthcare organizations to implement rigorous security controls,” said Jumio CEO Robert Prigg. “With personally identifiable information (PII), such as social security numbers , phone numbers, dates of birth and physical addresses were stolen during the attack, members of the US House of Representatives, their staffers and their families find themselves at risk of insurance fraud, identity theft. and account takeover attacks. Stolen information is already being sold online, creating further complications for victims.”
