Virginia and Washington D.C. have paused data collection after Bloomberg revealed their health insurance marketplaces were sharing sensitive citizen and race information with advertising technology companies.
Health insurance marketplaces in Virginia and Washington D.C. transmitted personal data including citizenship status and racial information to ad tech firms, according to a Bloomberg investigation. Both jurisdictions have now suspended the practice.
The marketplaces collected this demographic data as part of their standard enrollment processes. Rather than keeping the information private, they shared it with third-party advertising networks and data brokers. This enabled ad tech companies to target users based on their protected characteristics.
The data sharing raised significant privacy and discrimination concerns. Healthcare information combined with racial and citizenship data creates detailed profiles that advertisers could use to discriminate against vulnerable populations. Such practices potentially violate federal health privacy laws and state consumer protection regulations.
Virginia's marketplace was particularly aggressive in sharing data with multiple ad platforms. Washington D.C.'s system showed similar patterns. Neither jurisdiction had publicly disclosed these data sharing arrangements to consumers prior to the investigation.
Following Bloomberg's reporting, both marketplaces halted the collection and transmission of citizenship and race data to third parties. State officials indicated they would review their data practices and implement stronger privacy protections.
The incident highlights broader concerns about how government health platforms handle sensitive personal information. While healthcare providers are subject to strict privacy regulations under HIPAA, less clarity exists around how data brokers and ad tech companies can use demographic information obtained through health marketplaces.
Healthcare experts and privacy advocates have called for stronger federal guidelines requiring state and federal marketplaces to restrict data sharing. The issue affects millions of Americans who use health insurance marketplaces during annual enrollment periods.
Other state health insurance marketplaces have not yet confirmed whether they engage in similar data sharing practices. Congressional scrutiny of the issue is expected.
Americans are systematically targeting and disabling Flock Safety cameras across the country in a decentralized protest movement. The surveillance devices face everything from vandalism to theft as public opposition intensifies.
The US Justice Department has dismantled online infrastructure used by Chinese state-sponsored hackers targeting NASA, the Federal Reserve, and the Senate. The action represents a coordinated effort to disrupt cyber operations against American government agencies and critical infrastructure.
The U.S. Cybersecurity and Infrastructure Security Agency has issued a mandate requiring all federal agencies to patch an actively exploited remote code execution vulnerability in Citrix NetScaler appliances by Saturday.
A new Rowhammer attack called GPUThor can bypass error-correcting code (ECC) protections on NVIDIA GPUs, enabling denial-of-service attacks and root-level privilege escalation.