Washington Department of Social Health Services Data Breach Notice (Washington Attorney General)

The Washington Department of Social and Health Services has confirmed that a data breach on September 23, 2023 exposed the names, Social Security numbers, full dates of birth, and protected health information of 8,600 people. The state filing reporting the incident was submitted on June 30, 2026 — 1,011 days, or roughly 33 months, later.

A long delay between the breach and public notice

The gap between the September 23, 2023 incident date and the June 30, 2026 filing is the most striking detail in the record. Notification timelines vary by state law and the time required to complete an investigation, so the filing itself does not label the interval as unusual. What matters to anyone whose records were included is that nearly three years passed before the official notice reached the Attorney General’s office.

What the exposed information actually enables

A Social Security number paired with a full date of birth remains one of the highest-value combinations for identity theft. Criminals use this pair to open new credit accounts, file fraudulent tax returns, or create synthetic identities that can persist for years. Because neither piece of information can be reissued like a credit card or password, the risk does not expire when the news cycle moves on.

The inclusion of protected health information owned or licensed by a HIPAA covered entity adds another permanent concern. Medical records can be used for insurance fraud, prescription scams, or blackmail. Unlike financial accounts that can be frozen, health data cannot be “canceled.” Once it is out, it stays out.