Sensitive personal data of US House and Senate members hacked, offered for sale

Members of the House and Senate were informed on Wednesday that hackers may have gained access to their sensitive personal data in a breach of a Washington DC health insurance marketplace. Employees of the lawmakers and their families were also affected.

DC Health Link confirmed that data on an unspecified number of customers was affected and said it was notifying them and working with law enforcement. It said it was offering identity theft service to those affected and extending credit monitoring to all customers.

The FBI said it was aware of the incident and was assisting the investigation.

A broker on an online crime forum claimed to have records on 170,000 DC Health Link customers and was offering them for sale for an unspecified amount. The broker claimed they were stolen on Monday. The broker did not immediately respond to questions posed by the Associated Press on an encrypted chat site.

It was not possible to confirm the number claimed. Sample stolen data was posted on the site for a dozen apparent customers. It included social security numbers, addresses, names of employers, phone numbers, emails and addresses. The AP reached one of the dozen by dialing a listed number.

It recommended that anyone registered on the health insurance exchange freeze their credit to prevent identity theft.

The hack follows several recent breaches affecting US agencies. Hackers broke into a US Marshals Service computer system and activated ransomware on 17 February after stealing personally identifiable data about agency employees and targets of investigations.

There was no indication the Health Link breach was ransomware related.