Washington DSHS Data Breach Affects About 8,600 People

According to the department’s Notice of Data Breach, in March 2026 DSHS discovered that an employee had accessed client information in a DSHS internal client data system. The investigation determined that a DSHS employee accessed confidential client information for reasons unrelated to their job responsibilities. DSHS reported that it took action to investigate, terminated the employee’s access, and is taking steps to add safeguards and review its policies and procedures. The letter says DSHS is notifying every client whose record the employee viewed, even if the viewing was for work-related purposes.

DSHS began sending written notification letters to affected individuals in June 2026, and the incident was reported to the U.S. Department of Health and Human Services’ Office for Civil Rights. Insider breaches — where a person with legitimate access misuses it — are a recognized risk in government and healthcare settings, and they can be difficult to detect without active monitoring of access logs.

According to DSHS’s letter, the information the employee potentially accessed included full names, dates of birth, Social Security numbers, DSHS client numbers, and the general category of services received. DSHS stated that there was no evidence the employee had access to specific health information such as diagnoses, test results, treatments, claims, or chart notes.

Even without clinical details, the combination of names, dates of birth, and Social Security numbers is highly sensitive. Those elements are enough for identity thieves to attempt to open accounts or commit fraud, which is why DSHS advised affected individuals to monitor their accounts and credit reports for suspicious activity.

DSHS reported that approximately 8,600 individuals may have been affected. Because DSHS serves individuals and families relying on social and health services, many affected people are clients whose information the department maintained as part of program administration.

When personal information is accessed by someone acting outside the scope of their duties, the concern is not only what was viewed but how that information could be used or shared. Remaining vigilant over time is important, as exposed identity information can be misused long after the initial incident.

Keep your notification letter; it lists the types of information involved. Monitor your financial accounts and review your free credit reports at AnnualCreditReport.com for unfamiliar accounts or activity. You may also consider placing a fraud alert or a credit freeze with the major credit bureaus for added protection.

Because DSHS did not indicate in its notice that it was offering credit monitoring, affected individuals may want to take these protective steps proactively. A legal professional can also help you understand whether you may have legal options following the incident.

See our overview of the MBE CPAs data breach lawsuit for details on another reported incident.