{"id":316,"date":"2023-03-12T13:24:10","date_gmt":"2023-03-12T18:24:10","guid":{"rendered":"https:\/\/kentprotect.com\/?p=316"},"modified":"2023-04-19T00:57:01","modified_gmt":"2023-04-19T05:57:01","slug":"d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating","status":"publish","type":"post","link":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/","title":{"rendered":"D.C. Health Marketplace &#8220;human error&#8221; exposes PII of Congress on BreachForums and over 56,000+ customers, FBI &#038; Mandiant investigating"},"content":{"rendered":"<div class='booster-block booster-read-block'><\/div>\n<p class=\"wp-block-paragraph\">(Image source: D.C. Health Link, 2021)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Update 4\/18\/2023: Additional information about the breach was updated<\/em>, <em>including the cause being a misconfiguration. <\/em><\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>One-sentence summary: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">D.C. Health Link, an ACA health marketplace for members of Congress, was breached in March 2023 due to &#8220;human error&#8221;, and the breached data of over 56,000+ customers was offered for sale onto the dark web.<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Who was involved?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">D.C. Health Marketplace\/D.C. Health Link, D.C. Health Benefit Exchange Authority (DCHBX), 56,415 D.C. Health Link customers, members of Congress (including aides) and their families\/dependents, Mandiant, FBI, and a BreachForums threat actor. <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>What was the timeline?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">March 6, 2023: D.C. Health Link is allegedly breached by BreachForums members, and the data is posted up for sale on BreachForums. D.C. Health Link discovers the breach the same day. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">March 7, 2023: Stolen data is purchased by the FBI (Kofman, 2023, p. 2; Nobles et al., 2023). <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">March 8, 2023: Mandiant discovers the cause of the breach and helps remediate it (Sabin, 2023). Congressional members are notified of the breach via email and D.C. Health Link makes its first public notification. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">March 9, 2023: D.C. Health Link Executive Board procures 3 years of identity monitoring with all three credit bureaus for all D.C. Health Link members. Individualized notification begins. <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>What occurred?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">D.C. Health Link was exploited by members of BreachForums due to a misconfiguration, and the data was posted for sale online by IntelBroker (Sabin, 2023; Gatlan, 2023, para. 9). The FBI purchased some of the data from IntelBroker as part of an investigation (Nobles et al., 2023, para. 15). Breached data included: &#8220;Subscriber ID,Member ID,Policy ID,Status,First Name,Last Name,SSN,DOB,Gender,Relationship,Benefit Type,Plan Name,HIOS ID,Plan Metal Level,Carrier Name,Premium Amount,Premium Total,Policy APTC,Policy Employer Contribution,Coverage Start,Coverage End,Employer Name,Employer DBA,Employer FEIN,Employer HBX ID,Home Address,Mailing Address,Work Email,Home Email,Phone Number,Broker,Race,Ethnicity,Citizen Status,Plan Year Start,Plan Year End,Plan Year Status&#8221; (Gatlan, 2023, para. 8). <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Estimated costs:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Associated incident response costs including Mandiant, potential breach notification costs, identity and credit monitoring services: &#8220;3 years&#8221;&#8230; &#8220;protection for all three major credit bureaus for our affected customers&#8221; including dependents (and non-affected customers) (Kofman, 2023, p. 2). <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Involved laws: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regional: District\u2019s Consumer Security Breach Notification Act, D.C. Code \u00a7 28\u20133851<\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Root cause: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Misconfiguration: publicly exposed cloud storage bucket (Sabin, 2023) <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Lessons learned: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Doer\/checker policy. Restricting public read access modification rights to delegated individuals. Continuous vulnerability scanning and assessment. SIEM\/IT alerting for new public read access folders\/files. Automatic rollback configurations (e.g., Lambda &amp; Cloudwatch Event Rule).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">D.C. Health Link&#8217;s Executive Director enumerated existing controls prior to the breach, including: &#8220;FortiNet &amp; FortiGate, CloudFlare, Splunk, and Tenable Nessus&#8221; (Kofman, 2023, p. 4). Mila Kofman also claims that they average 2,000 malicious attacks in a day (and up to 560,000) (Kofman, 2023, p. 4). This illustrates the fact that organizations can have an array of enterprise-grade controls in action, but miss basic configuration principles and, thus, fall prey to cybercrime. <\/p>\n\n\n\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Sources: <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Broadwater, L. (2023, March 11). <em>D.C. and Congress Health Data Breach Affected More Than 56,000<\/em>. The New York Times. https:\/\/www.nytimes.com\/2023\/03\/10\/us\/politics\/dc-hack-data-congress-health-marketplace.html<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">D.C. Health Link. (2021, May). <em>dc-health-link-blog.jpg<\/em>. DC Chamber of Commerce. https:\/\/dcchamber.org\/wp-content\/uploads\/2021\/05\/dc-health-link-blog.jpg<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Gatlan, S. (2023, March 10). <em>FBI investigates data breach impacting U.S. House members and staff<\/em>. BleepingComputer. Retrieved March 12, 2023, from https:\/\/www.bleepingcomputer.com\/news\/security\/fbi-investigates-data-breach-impacting-us-house-members-and-staff\/<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kofman, M. (2023). JOINT HEARING BEFORE THE UNITED STATES HOUSE OVERSIGHT AND ACCOUNTABILITY SUBCOMMITTEE ON CYBERSECURITY, INFORMATION TECHNOLOGY, AND GOVERNMENT INNOVATION AND HOUSE ADMINISTRATION SUBCOMMITTEE ON OVERSIGHT. In <em>Committee on Oversight and Accountability<\/em>. United States House of Representatives. Retrieved April 19, 2023, from https:\/\/oversight.house.gov\/wp-content\/uploads\/2023\/04\/Mila-Kofman-Written-Testimony-April-19-2023.pdf<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nobles, R., V., F. T., Richards, Z., &amp; Collier, K. (2023, March 9). <em>FBI finds personal information of lawmakers and staff being sold on dark web<\/em>. NBC News. Retrieved March 12, 2023, from https:\/\/www.nbcnews.com\/politics\/congress\/data-breach-hits-lawmakers-staff-capitol-hill-rcna74061<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sabin, S. (2023, April 18). 17 House members, 585 aides affected in D.C. health insurance breach. <em>Axios<\/em>. https:\/\/www.axios.com\/2023\/04\/18\/dc-health-insurance-breach-data-hearing<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-4-3 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"D.C. Health Marketplace BreachForums hack breaches PII of Congress and over 56,000+ customers\" width=\"640\" height=\"480\" src=\"https:\/\/www.youtube.com\/embed\/YVujzeL_lNc?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><figcaption class=\"wp-element-caption\">YouTube\/Blog Notification Post<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>(Image source: D.C. Health Link, 2021) Update 4\/18\/2023: Additional information about the breach was updated, including the cause<\/p>\n","protected":false},"author":4,"featured_media":317,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[320,322,68,3,12,323,13,76,63,274,316,75,61,11,317,10,77,74,14,201,107,325,69,71,241,45,296,295,318,319,43,44,326,72,70,8,27,321,297,67,62,324,15],"class_list":["post-316","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-breach-report","tag-aca","tag-affordablecareact","tag-been-pwned","tag-breach-report","tag-breaches","tag-breachforums","tag-ciso","tag-cloud","tag-computer-security","tag-computers","tag-congress","tag-cyber-security","tag-cybercrime","tag-cybersecurity","tag-d-c-health-link","tag-dallas","tag-dark-web","tag-data-breach","tag-executive","tag-exfiltration","tag-fbi","tag-federal","tag-have-been-pwned","tag-have-i-pwned","tag-haveibeenpwned","tag-healthcare","tag-healthcare-breaches","tag-healthcareit","tag-healthexchange","tag-healthmarketplace","tag-hipaa","tag-hitech","tag-houseofrepresentatives","tag-i-been-pwned","tag-i-have-been-pwned","tag-kent-protect","tag-kentprotect","tag-obama","tag-pii","tag-pwned","tag-security","tag-senate","tag-summary"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>D.C. Health Marketplace &quot;human error&quot; exposes PII of Congress on BreachForums and over 56,000+ customers, FBI &amp; Mandiant investigating - Kent Protect<\/title>\n<meta name=\"description\" content=\"D.C. Health Link, an ACA health marketplace for members of Congress, was breached in March 2023 due to &quot;human error&quot;, and the breached data of over 56,000+ customers was offered for sale onto the dark web.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"D.C. Health Marketplace &quot;human error&quot; exposes PII of Congress on BreachForums and over 56,000+ customers, FBI &amp; Mandiant investigating - Kent Protect\" \/>\n<meta property=\"og:description\" content=\"D.C. Health Link, an ACA health marketplace for members of Congress, was breached in March 2023 due to &quot;human error&quot;, and the breached data of over 56,000+ customers was offered for sale onto the dark web.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/\" \/>\n<meta property=\"og:site_name\" content=\"Kent Protect\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-12T18:24:10+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-04-19T05:57:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/dc-health-link-blog.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"897\" \/>\n\t<meta property=\"og:image:height\" content=\"541\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Kyler Kent CISSP\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Kyler Kent CISSP\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/\"},\"author\":{\"name\":\"Kyler Kent CISSP\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/person\\\/f9b4d76bd2f5b5559a08ad2e004a1116\"},\"headline\":\"D.C. Health Marketplace &#8220;human error&#8221; exposes PII of Congress on BreachForums and over 56,000+ customers, FBI &#038; Mandiant investigating\",\"datePublished\":\"2023-03-12T18:24:10+00:00\",\"dateModified\":\"2023-04-19T05:57:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/\"},\"wordCount\":692,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/dc-health-link-blog.jpg\",\"keywords\":[\"ACA\",\"affordablecareact\",\"been pwned\",\"breach report\",\"breaches\",\"breachforums\",\"ciso\",\"cloud\",\"computer security\",\"computers\",\"Congress\",\"cyber security\",\"cybercrime\",\"cybersecurity\",\"D.C. Health Link\",\"dallas\",\"dark web\",\"data breach\",\"executive\",\"exfiltration\",\"FBI\",\"federal\",\"have been pwned\",\"have I pwned\",\"haveibeenpwned\",\"healthcare\",\"healthcare breaches\",\"healthcareIT\",\"Healthexchange\",\"healthmarketplace\",\"HIPAA\",\"HITECH\",\"Houseofrepresentatives\",\"I been pwned\",\"I have been pwned\",\"kent protect\",\"kentprotect\",\"Obama\",\"PII\",\"pwned\",\"security\",\"Senate\",\"summary\"],\"articleSection\":[\"The Breach Report!\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/\",\"name\":\"D.C. Health Marketplace \\\"human error\\\" exposes PII of Congress on BreachForums and over 56,000+ customers, FBI & Mandiant investigating - Kent Protect\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/dc-health-link-blog.jpg\",\"datePublished\":\"2023-03-12T18:24:10+00:00\",\"dateModified\":\"2023-04-19T05:57:01+00:00\",\"description\":\"D.C. Health Link, an ACA health marketplace for members of Congress, was breached in March 2023 due to \\\"human error\\\", and the breached data of over 56,000+ customers was offered for sale onto the dark web.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#primaryimage\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/dc-health-link-blog.jpg\",\"contentUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/dc-health-link-blog.jpg\",\"width\":897,\"height\":541,\"caption\":\"D.C. Health Link logo\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/2023\\\/03\\\/12\\\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/kentprotect.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"D.C. Health Marketplace &#8220;human error&#8221; exposes PII of Congress on BreachForums and over 56,000+ customers, FBI &#038; Mandiant investigating\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#website\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/\",\"name\":\"Kent Protect\",\"description\":\"Starring the Breach Report! and other security and cybersecurity series\",\"publisher\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/kentprotect.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#organization\",\"name\":\"Kent Protect\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png\",\"contentUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png\",\"width\":209,\"height\":161,\"caption\":\"Kent Protect\"},\"image\":{\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/#\\\/schema\\\/person\\\/f9b4d76bd2f5b5559a08ad2e004a1116\",\"name\":\"Kyler Kent CISSP\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Retry-3-150x150.jpg\",\"url\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Retry-3-150x150.jpg\",\"contentUrl\":\"https:\\\/\\\/kentprotect.com\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/Retry-3-150x150.jpg\",\"caption\":\"Kyler Kent CISSP\"},\"description\":\"Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike\u2019s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation\u2014turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master\u2019s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect \u2013 Professional, AWS Security \u2013 Specialty, and multiple CrowdStrike credentials. He writes to close the gap between \u201cwhat the textbook says\u201d and what analysts actually do on shift with his published book: \\\"SOC Analyst Career Guide\\\" (ISBN-13: 9781835467466). https:\\\/\\\/linktr.ee\\\/kentprotect.com Corrections: corrections@kentprotect.com\",\"sameAs\":[\"http:\\\/\\\/kylerkent.com\"],\"url\":\"https:\\\/\\\/kentprotect.com\\\/index.php\\\/author\\\/kylerkent\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"D.C. Health Marketplace \"human error\" exposes PII of Congress on BreachForums and over 56,000+ customers, FBI & Mandiant investigating - Kent Protect","description":"D.C. Health Link, an ACA health marketplace for members of Congress, was breached in March 2023 due to \"human error\", and the breached data of over 56,000+ customers was offered for sale onto the dark web.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/","og_locale":"en_US","og_type":"article","og_title":"D.C. Health Marketplace \"human error\" exposes PII of Congress on BreachForums and over 56,000+ customers, FBI & Mandiant investigating - Kent Protect","og_description":"D.C. Health Link, an ACA health marketplace for members of Congress, was breached in March 2023 due to \"human error\", and the breached data of over 56,000+ customers was offered for sale onto the dark web.","og_url":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/","og_site_name":"Kent Protect","article_published_time":"2023-03-12T18:24:10+00:00","article_modified_time":"2023-04-19T05:57:01+00:00","og_image":[{"width":897,"height":541,"url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/dc-health-link-blog.jpg","type":"image\/jpeg"}],"author":"Kyler Kent CISSP","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Kyler Kent CISSP","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#article","isPartOf":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/"},"author":{"name":"Kyler Kent CISSP","@id":"https:\/\/kentprotect.com\/#\/schema\/person\/f9b4d76bd2f5b5559a08ad2e004a1116"},"headline":"D.C. Health Marketplace &#8220;human error&#8221; exposes PII of Congress on BreachForums and over 56,000+ customers, FBI &#038; Mandiant investigating","datePublished":"2023-03-12T18:24:10+00:00","dateModified":"2023-04-19T05:57:01+00:00","mainEntityOfPage":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/"},"wordCount":692,"commentCount":0,"publisher":{"@id":"https:\/\/kentprotect.com\/#organization"},"image":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#primaryimage"},"thumbnailUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/dc-health-link-blog.jpg","keywords":["ACA","affordablecareact","been pwned","breach report","breaches","breachforums","ciso","cloud","computer security","computers","Congress","cyber security","cybercrime","cybersecurity","D.C. Health Link","dallas","dark web","data breach","executive","exfiltration","FBI","federal","have been pwned","have I pwned","haveibeenpwned","healthcare","healthcare breaches","healthcareIT","Healthexchange","healthmarketplace","HIPAA","HITECH","Houseofrepresentatives","I been pwned","I have been pwned","kent protect","kentprotect","Obama","PII","pwned","security","Senate","summary"],"articleSection":["The Breach Report!"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/","url":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/","name":"D.C. Health Marketplace \"human error\" exposes PII of Congress on BreachForums and over 56,000+ customers, FBI & Mandiant investigating - Kent Protect","isPartOf":{"@id":"https:\/\/kentprotect.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#primaryimage"},"image":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#primaryimage"},"thumbnailUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/dc-health-link-blog.jpg","datePublished":"2023-03-12T18:24:10+00:00","dateModified":"2023-04-19T05:57:01+00:00","description":"D.C. Health Link, an ACA health marketplace for members of Congress, was breached in March 2023 due to \"human error\", and the breached data of over 56,000+ customers was offered for sale onto the dark web.","breadcrumb":{"@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#primaryimage","url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/dc-health-link-blog.jpg","contentUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/dc-health-link-blog.jpg","width":897,"height":541,"caption":"D.C. Health Link logo"},{"@type":"BreadcrumbList","@id":"https:\/\/kentprotect.com\/index.php\/2023\/03\/12\/d-c-health-marketplace-breachforums-hack-breaches-pii-of-congress-and-over-56000-customers-fbi-investigating\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/kentprotect.com\/"},{"@type":"ListItem","position":2,"name":"D.C. Health Marketplace &#8220;human error&#8221; exposes PII of Congress on BreachForums and over 56,000+ customers, FBI &#038; Mandiant investigating"}]},{"@type":"WebSite","@id":"https:\/\/kentprotect.com\/#website","url":"https:\/\/kentprotect.com\/","name":"Kent Protect","description":"Starring the Breach Report! and other security and cybersecurity series","publisher":{"@id":"https:\/\/kentprotect.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kentprotect.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/kentprotect.com\/#organization","name":"Kent Protect","url":"https:\/\/kentprotect.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kentprotect.com\/#\/schema\/logo\/image\/","url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/04\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png","contentUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/04\/cropped-FullLogo_Transparent-1-with-KP-Smaller.png","width":209,"height":161,"caption":"Kent Protect"},"image":{"@id":"https:\/\/kentprotect.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/kentprotect.com\/#\/schema\/person\/f9b4d76bd2f5b5559a08ad2e004a1116","name":"Kyler Kent CISSP","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Retry-3-150x150.jpg","url":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Retry-3-150x150.jpg","contentUrl":"https:\/\/kentprotect.com\/wp-content\/uploads\/2023\/03\/Retry-3-150x150.jpg","caption":"Kyler Kent CISSP"},"description":"Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike\u2019s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation\u2014turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master\u2019s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect \u2013 Professional, AWS Security \u2013 Specialty, and multiple CrowdStrike credentials. He writes to close the gap between \u201cwhat the textbook says\u201d and what analysts actually do on shift with his published book: \"SOC Analyst Career Guide\" (ISBN-13: 9781835467466). https:\/\/linktr.ee\/kentprotect.com Corrections: corrections@kentprotect.com","sameAs":["http:\/\/kylerkent.com"],"url":"https:\/\/kentprotect.com\/index.php\/author\/kylerkent\/"}]}},"_links":{"self":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts\/316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/comments?post=316"}],"version-history":[{"count":5,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts\/316\/revisions"}],"predecessor-version":[{"id":577,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/posts\/316\/revisions\/577"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/media\/317"}],"wp:attachment":[{"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/media?parent=316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/categories?post=316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kentprotect.com\/index.php\/wp-json\/wp\/v2\/tags?post=316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}