A recent data breach at DC Health Link, the Washington, D.C.-based health insurance exchange, was caused by a misconfigured server, according to the executive director’s statement during a House Oversight Committee hearing. The breach, discovered on March 6, allowed unauthorized access to sensitive personal information of more than 56,000 current and former customers, including members of Congress and their families.

Executive director Mila Kofman explained that the server configuration error allowed the theft of two reports containing names, dates of birth, and social security numbers. "The cause of this breach was human mistake," Kofman stated, emphasizing that the server was not intentionally left exposed. Among those affected were 17 House members, 43 of their dependents, 585 House staffers, and 231 of their dependents.

Kofman apologized to Congress and confirmed that immediate remedial actions were taken. The exchange engaged cybersecurity experts, including Mandiant and the FBI Cyber Security Task Force, to investigate the incident and enhance security. "We are working hard to make sure this never happens again," Kofman said, vowing a thorough review and upgrades of the system’s protections.