On March 8, DC Health Link confirmed reports that customer information had been exposed. In an update posted two days later, the health insurance marketplace disclosed that 56,415 of its customers were impacted by the breach. Compromised information includes names, Social Security numbers, dates of birth, gender, health plan information, employer information and enrollee information (including addresses), according to DC Health Link.

While this kind of breach is not novel, DC Health Link’s customers include lawmakers. CNN reported that the breach impacted members of the House, their staff and Senate employees. With prominent lawmakers involved, could this breach result in increased scrutiny on cybersecurity and the impact of cyberattacks?

The Breach

DC Health link divided the more than 56,000 people affected by the breach into two groups. The first group includes individuals whose information has been posted publicly. The second group includes people whose information has been stored in the same manner as the first group.

“The issue which led to this data breach has been identified and eliminated. DC Health Link is working with third-party forensic experts to conduct a comprehensive review and to strengthen our security defenses,” according to the DC Health Link statement.

The Consequences

The healthcare industry is a popular target for breaches. Care providers and insurance companies safeguard valuable data. “Threat actors believe that healthcare providers and related organizations have no option but to pay the ransom, as restoring operations can mean the difference between life and death,” Immanuel Chavoya, threat detection and response strategist at cybersecurity company SonicWall, points out.

Once in the hands of threat actors, compromised information can be used in a number of ways for gain. “Criminals and spies will frequently use stolen PII to conduct spear-phishing email attacks, which are targeted emails that appear to be from a trusted source and can lead to further breaches or data theft,” says Eric O’Neill, national security strategist at cloud computing company VMware.

Anyone’s personal information can be used by threat actors, but there are additional concerns when public figures are involved. “Given many of those affected are from the DC political sphere, including White House and Congressional staffers, exposure of physical addresses opens up greater concerns regarding the safety of those individuals exposed on the dark web,” says Tim Kosiba, CEO of government expansion initiative Bracket f, Inc. a subsidiary of cybersecurity service provider Redacted, Inc.

Could the public prominence of some of the victims of the data breach mean DC Health Link will face increased pressure? “It is likely. We can expect to see a task force composed of CISA, the FBI, HIS, and perhaps even the Capitol Hill Police working on this right now,” says Mark Bowling, vice president of security response services at cybersecurity firm ExtraHop.

The Outlook on National Cybersecurity

This breach has several implications for the outlook on national cybersecurity. First, it serves as a stark reminder that government data too is vulnerable. “No organization is immune to cyberattacks and…even government-run entities can fall victim to breaches,” Chavoya says.

While the DC Health Link breach draws more attention to data breaches and the importance of cybersecurity, it also calls into question whether enough is being done. “The breach can erode public trust in government-run entities and the private sector's ability to protect personal information. It may lead to increased public demand for stronger cybersecurity measures and greater transparency around how organizations handle personal data,” Chavoya says.

Cybersecurity is already on the radar of the Biden-Harris administration. This month, it released a new National Cybersecurity Strategy. The sweeping strategy aims to shift responsibility for cybersecurity away from end users and to larger stakeholders. The strategy also outlines plans to incentivize investment in cybersecurity. Finding ways to foster collaboration between public and private stakeholders will be vital to achieving the objectives of this new strategy. President Biden’s budget for fiscal year 2024, announced shortly after the new National Cybersecurity Strategy, includes a total of $3.1 billion for the Cybersecurity and Infrastructure Security Agency (CISA).

Continued focus on cybersecurity will be essential to combat the constantly evolving methods employed by threat actors. “Our national cyber resources need to look for opportunities to impose costs against these adversaries and countries facilitating the attackers,” Kosiba urges. “There must be consequences, or these breaches will persist.”

What to Read Next:

Looking at the Dole Cyberattack and the Future of Critical Infrastructure Cybersecurity

Closing the Cybersecurity Talent Gap

Malicious Actors and ChatGPT: IT Security on the Lookout