Washington DSHS Data Breach: What Affected Clients Need to Know

According to the department’s Notice of Data Event, on or about March 2026 DSHS became aware of suspicious activity involving its internal systems. The investigation determined that a DSHS employee accessed confidential client information for reasons unrelated to their job responsibilities. DSHS reported that it took action to investigate, secured its systems, terminated the employee’s access, and strengthened its overall security posture.

DSHS began sending written notification letters to affected individuals in June 2026, and the incident was reported to the U.S. Department of Health and Human Services’ Office for Civil Rights. Insider breaches — where a person with legitimate access misuses it — are a recognized risk in government and healthcare settings, and they can be difficult to detect without active monitoring of access logs.

According to public reporting, the information the employee potentially accessed included full names, dates of birth, Social Security numbers, DSHS client numbers, and program enrollment details. DSHS stated that there was no evidence the employee had access to specific health information such as diagnoses, test results, treatments, claims, or chart notes.

Even without clinical details, the combination of names, dates of birth, and Social Security numbers is highly sensitive. Those elements are enough for identity thieves to attempt to open accounts or commit fraud, which is why DSHS advised affected individuals to monitor their accounts and credit reports for suspicious activity.

DSHS reported that approximately 8,600 individuals may have been affected. Because DSHS serves individuals and families relying on social and health services, many affected people are clients whose information the department maintained as part of program administration.

When personal information is accessed by someone acting outside the scope of their duties, the concern is not only what was viewed but how that information could be used or shared. Remaining vigilant over time is important, as exposed identity information can be misused long after the initial incident.

Keep your notification letter, as the specific data elements involved vary by individual and are detailed in each letter. Monitor your financial accounts and review your free credit reports at AnnualCreditReport.com for unfamiliar accounts or activity. You may also consider placing a fraud alert or a credit freeze with the major credit bureaus for added protection.

Because DSHS did not indicate in its notice that it was offering credit monitoring, affected individuals may want to take these protective steps proactively. A legal professional can also help you understand whether you may have legal options following the incident.

See our overview of the MBE CPAs data breach lawsuit for details on another reported incident.