Class Action Says DC Health Link Data Breach Impacted Members of Congress, Thousands of Consumers

New to ClassAction.org? Read our Newswire Disclaimer

District of Columbia Health Benefit Exchange Authority, also known as DC Health Link, faces a proposed class action over a 2023 data breach that exposed the personal information of thousands of individuals, including members of Congress, designated staff and their families.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 45-page lawsuit claims DC Health Link, the district’s health insurance marketplace, stored information on its computer network in a “reckless manner,” allowing a cybercriminal to access, extract and publicly publish plan holders’ sensitive data. According to the case, the breach went undetected for an “undetermined amount of time” until the publication of the stolen information was made known to DC Health Link on March 6.

According to the DC Health Link notice letter, the data compromised in the incident included consumers’ names; Social Security numbers; dates of birth; gender; and health plan, employer and enrollee information (e.g., address, email, phone number, race, ethnicity, and citizenship status), the suit relays.

“Although DC Health Link’s website states that the breach affected just over 56,000 customers’ data, an involved criminal entity was attempting to sell on the dark web the personal data of over 170,000 individuals from this Data Breach,” the complaint states.

The filing alleges that the incident was a direct result of DC Health Link’s failure to implement adequate cybersecurity measures, despite being obligated to protect consumer data by federal regulations, industry standards and common law. What’s more, DC Health Link falsely assured consumers that it will “encrypt credit card numbers and other data that must remain secure to meet legal requirements,” the lawsuit contends.

Per the case, the insurance provider’s negligence is compounded by the fact that data-security incidents are a well-known and foreseeable risk to entities that store personal information.

For victims, the consequences of having their information traded on the dark web are “long-lasting and severe,” the suit says, as they must spend a considerable amount of time, money and effort monitoring their accounts for signs of identity theft or fraud.

The plaintiff, a Colorado resident, says she has obtained the three-year credit monitoring service offered by DC Health Link in the wake of the data breach but believes that the gesture is “inadequate” since her private data is likely to be traded repeatedly on the dark web for years to come.

According to a letter sent by House Speaker Kevin McCarthy and House Minority Leader Hakeem Jeffries to DC Health Link Executive Director Mila Kofman, the breach “significantly increases the risk that Members, staff, and their families will experience identity theft, financial crimes, and physical threats—already an ongoing concern,” the complaint relays.

The lawsuit looks to cover anyone whose private information was maintained on DC Health Link’s computer systems and was sent a notice of the insurance provider’s 2023 data breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org's free weekly newsletter here.