Washington DSHS Insider Breach Exposes Personal Data of 8,600 Individuals
The Washington Department of Social and Health Services (DSHS) has disclosed an insider data breach affecting approximately 8,600 individuals. A DSHS employee was found to have accessed an internal client data system without authorization, viewing records containing sensitive information, including full names, dates of birth, Social Security numbers, DSHS client numbers, and program enrollment details.
The investigation revealed no evidence that health-related data such as diagnoses, test results, or treatment records was accessed. While the employee’s motives remain unclear, DSHS confirmed the access was unrelated to job duties. The timeline of the unauthorized activity and its detection remains unspecified.
Upon discovery, DSHS took immediate action to halt further access, and the employee is no longer with the department. It is unknown whether the departure was due to termination or voluntary resignation. Affected individuals are being notified by mail and advised to monitor their accounts and credit reports for suspicious activity.
DSHS is collaborating with state and local law enforcement as part of an ongoing investigation. The department is also reviewing internal policies and implementing additional safeguards to strengthen data privacy and security measures.
Source: https://www.hipaajournal.com/washington-dept-health-social-services-insider-breach-2026/
Washington Department of Social and Health Services TPRM report: https://www.rankiteo.com/company/washingtondepartmentofsocialandhealthservices
"id": "was1782815303",
"linkid": "washingtondepartmentofsocialandhealthservices",
"type": "Breach",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '8,600 individuals',
'industry': 'Health and Human Services',
'location': 'Washington, USA',
'name': 'Washington Department of Social and Health '
'Services (DSHS)',
'type': 'Government Agency'}],
'attack_vector': 'Unauthorized internal access',
'customer_advisories': 'Affected individuals advised to monitor accounts and '
'credit reports for suspicious activity',
'data_breach': {'number_of_records_exposed': '8,600',
'personally_identifiable_information': 'Full names, dates of '
'birth, Social '
'Security numbers, '
'DSHS client numbers, '
'program enrollment '
'details',
'sensitivity_of_data': 'High (Social Security numbers, dates '
'of birth, client numbers)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII)'},
'description': 'A DSHS employee was found to have accessed an internal client '
'data system without authorization, viewing records containing '
'sensitive information, including full names, dates of birth, '
'Social Security numbers, DSHS client numbers, and program '
'enrollment details. The investigation revealed no evidence '
'that health-related data was accessed.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to DSHS',
'data_compromised': 'Personal data (full names, dates of birth, '
'Social Security numbers, DSHS client numbers, '
'program enrollment details)',
'identity_theft_risk': 'High (due to exposure of Social Security '
'numbers and personal data)',
'systems_affected': 'Internal client data system'},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'corrective_actions': 'Reviewing internal '
'policies, implementing '
'additional safeguards for '
'data privacy and security',
'root_causes': 'Insufficient access controls, '
'unauthorized internal access'},
'recommendations': 'Monitor accounts and credit reports for suspicious '
'activity',
'references': [{'source': 'Washington DSHS Disclosure'}],
'response': {'communication_strategy': 'Affected individuals notified by mail',
'containment_measures': 'Immediate halt of unauthorized access, '
'employee no longer with the department',
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes (state and local law '
'enforcement)',
'remediation_measures': 'Reviewing internal policies, '
'implementing additional safeguards for '
'data privacy and security'},
'threat_actor': 'DSHS employee',
'title': 'Washington DSHS Insider Breach Exposes Personal Data of 8,600 '
'Individuals',
'type': 'Insider Threat',
'vulnerability_exploited': 'Insufficient access controls'}