(AP) — Federal investigators found significant cybersecurity weaknesses in the health insurance websites of California, Kentucky and Vermont that could enable hackers to get their hands on sensitive personal information about hundreds of thousands of people, The Associated Press has learned. The vulnerabilities were discovered by the Government Accountability Office, the investigative arm of Congress, and shared with state officials last September. Created under President Barack Obama's health care overhaul, the exchanges are online marketplaces where people who have no health insurance through their jobs can buy government-subsidized private coverage. According to the GAO, one state did not encrypt passwords, potentially making it easy for hackers to gain access to individual accounts. According to the GAO report, Healthcare.gov had 316 security incidents between October 2013 and March 2015. Since the GAO audit, Lee's letter said, Covered California conducts more frequent scans to identify threats, and any critical findings will be immediately fixed. From day one, Covered California has followed the rigorous guidelines outlined in federal and state security regulations designed to protect our consumers' private information.