FBI investigates data breach impacting U.S. House members and staff

The FBI is investigating a data breach affecting U.S. House of Representatives members and staff after their account and sensitive personal information was stolen from DC Health Link's servers.

DC Health Link is the organization that administers the health care plans of U.S. House members, their staff, and their families.

Impacted individuals were notified today of the breach in an email from Catherine L. Szpindor, the U.S. House Chief Administrative Officer, as first reported by DailyCaller.

"DC Health Link suffered a significant data breach yesterday potentially exposing the Personal Identifiable Information (PII) of thousands of enrollees. As a Member or employee eligible for health insurance through the D.C. Health Link, your data may have been comprised," Szpindor said.

"Currently, I do not know the size and scope of the breach, but have been informed by the Federal Bureau of Investigation (FBI) that account information and Pit of hundreds of Mernber and House staff were stolen.

"It is important to note that at this time, it does not appear that Members or the House of Representatives were the specific target of the attack."

Stolen data already up for sale online

While the email sent by House CAO Szpindor doesn't have any details regarding the stolen data, BleepingComputer discovered that at least one threat actor (known as IntelBroker) is selling the U.S. House members' information stolen from DC Health Link's servers on a hacking forum.

A sample of stolen data with the database header shows it contains the information of roughly 170,000 affected individuals, including their names, dates of birth, addresses, email addresses, phone numbers, Social Security Numbers, and much more (the entire list is available below).

Subscriber ID,Member ID,Policy ID,Status,First Name,Last Name,SSN,DOB,Gender,Relationship,Benefit Type,Plan Name,HIOS ID,Plan Metal Level,Carrier Name,Premium Amount,Premium Total,Policy APTC,Policy Employer Contribution,Coverage Start,Coverage End,Employer Name,Employer DBA,Employer FEIN,Employer HBX ID,Home Address,Mailing Address,Work Email,Home Email,Phone Number,Broker,Race,Ethnicity,Citizen Status,Plan Year Start,Plan Year End,Plan Year Status

The data was posted for sale on Monday, March 6, and IntelBroker claims it was stolen after breaching the DC.gov Health Benefit Exchange Authority.

U.S. House members' data up for sale (BleepingComputer)

 

"I am looking for undisclosed amount in XMR crypto currency. Contact me on keybase @ IntelBroker. Middleman only," the threat actor says.

The threat actor also claims that the stolen information has already been sold to at least one buyer.

Update 6:24 PM ET: 

In a statement to BleepingComputer, Adam Hudson, the Public Information Officer for Health Benefit Exchange Authority, confirmed that some of stolen DC Health Link data was exposed online and that notifications will be sent to those affected.

"We can confirm reports that data for some DC Health Link customers has been exposed on a public forum. We have initiated a comprehensive investigation and are working with forensic investigators and law enforcement.  Concurrently, we are taking action to ensure the security and privacy of our users’ personal information.  We are in the process of notifying impacted customers and will provide identity and credit monitoring services.  In addition, and out of an abundance of caution, we will also provide credit monitoring services for all of our customers. The investigation is still ongoing and we will provide more information as we have more to share."

Source