When Kristin Wallace received her new Medicaid card in the mail, everything appeared in order. The paper card bore the logo of D.C.’s Department of Health Care Finance and listed her name, home address and a web link directing her to the agency’s portal.
The 34-year-old had just moved back into her mother’s house in Northwest Washington after several years in Los Angeles and, still without a job, had applied for Medicaid to get treatment for a number of medical conditions.
But when Wallace entered the link from the card into her computer — expecting to select a health care provider — it instead delivered her to a webpage with text that was not in English and prominently featured seemingly pornographic content.
Shocked, Wallace quickly closed the site, thinking something must be wrong with her computer, or that she must have typed it in wrong, she recounted in an interview. She tried several more times, but no matter how meticulously she copied the web address listed on the card, the same graphic image flashed on her laptop screen.
The site was “just like a big-boobed, blonde cartoon woman, and it’s in a language that I can’t read,” Wallace said. “I didn’t linger because I didn’t want my computer to be compromised.”
In a statement, the Department of Health Care Finance confirmed the authenticity of the mailer, which it said included an outdated URL ending in “.com” that had previously been used by the agency. The correct website uses “.gov.”
The agency apologized to any resident who may have received one with the bad web address.
Wallace said she called the city’s fraud hotline and other phone numbers listed on the Medicaid card but received few answers. So she decided to post about it on the popular D.C. subreddit, r/WashingtonDC.
“I just moved back to DC two months ago and fumbling through the Medicaid sign up process. An OFFICIAL piece of mail I received from DHCF sent me to a porn/phishing site,” Wallace wrote in the post, along with a photo of her card. “Luckily I’m a (mostly) competent 30 something, but I feel bad for any elderly people who have received this!”
As of Thursday, the post has racked up more than 460 reactions and 50 comments from users trying to get to the bottom of what happened or merely criticizing D.C. websites. “Genuinely insane,” one commenter wrote.
Days later, Wallace said she still couldn’t believe this had been allowed to happen.
“It just seems like this should have raised so many red flags, and it’s just like, who didn’t double check that the URL was correct before mailing sensitive information to I don’t even know how many people?” she said.
It is unclear how many residents may have received materials with the same link, but Dorinda White, a department spokesperson, said it could have gone to anyone newly enrolled in Medicaid or who requested a replacement card.
White said the agency is conducting a “full audit of all printed and digital materials to determine the exact number of mailers that included the outdated web address.” She added that no department systems were compromised and no protected data was exposed.
White said the outdated website had been managed by a former contractor for the agency and used in D.C. Medicaid materials for several years until the contract ended in February.
The domain was then purchased by a “nongovernmental organization,” White said.
According to internet domain registry records, the site was again registered Aug. 14 via a Singapore-based domain company. The registrant’s identity is redacted in the filing but a city in Cambodia is listed as its mailing address.
In a separate incident from July, the Health Care Finance agency issued a notice that it had inadvertently allowed private information about its program holders to be accessed on its website for almost three years.
Josh Jacobson, a Ward 1 Advisory Neighborhood Commissioner and tech consultant who posted on X about the mailer, said it is relatively common for out-of-use official websites to be taken over by internet scammers or other unscrupulous entities.
“There are a lot of bad actors that are out there that try to find domains that used to be in either the government’s set of domains or companies’ prominent domains … and put content on there that might get people to either purchase things or put in their data,” Jacobson said.
In 2023, for example, the Maryland Motor Vehicle Administration reported that thousands of commemorative license plates featuring scenes from the War of 1812 displayed an outdated URL that went to a Philippine gambling site. The state subsequently recovered the domain.
“Everyone knows that this could be a problem because this is a common attack vector,” Jacobson said, “so we should be extra diligent in making sure that we don’t fall into that same problem.”
Wallace said she’s glad she could bring attention to the error but that she still needs to figure out her insurance and hopefully find a job.
She joked that the city should hire her to check URLs on public documents.
“I can be the domain checker for the entire D.C. government,” she said. “I have so much time.”
The post D.C. mailer sent to Medicaid recipients directed people to adult site appeared first on Washington Post.
