Vermont recently confirmed that a security breach of the state’s health-care exchange website gave at least one user access to another resident’s social security number, a disclosure that has the exchange’s top official in hot water.

The Vermont Health Connect’s privacy watchdog reported the security breach in a letter to the federal Centers for Medicare & Medicaid Services. According to that report, one consumer who had logged on to the exchange’s website received a copy of his application for insurance in the mail, from an unnamed sender. A note scrawled on the back of the envelope read: “VERMONT HEALTH CONNECT IS NOT A SECURE WEBSITE!”

The Department of Vermont Health Access commissioner Mark Larson told it was the only security breach to occur since the site launched October 1. But he had told state legislators at a hearing on November 5 that his department had only investigated one complaint about security breaches, and that the complaint was unfounded.