Illinois Department of Human Services (IDHS) suffered a data breach that impacted 700K individuals

Illinois Department of Human Services (IDHS) disclosed a data breach that exposed personal and health data for nearly 700,000 residents. According to IDHS press release, the breach stemmed from misconfigured privacy settings that made internal planning maps publicly viewable, revealing details from April 2021 to September 2025.

The exposure affected about 32,401 Division of Rehabilitation Services customers who had names, addresses, case numbers, referral sources and recipient status exposed, and 672,616 Medicaid and Medicare Savings Program recipients who had addresses, case numbers, demographics and plan names exposed, though no names were included.

IDHS stated access to the maps was restricted after discovery and a Secure Map Policy was implemented to limit map access by role and prohibit uploading identifiable information to public mapping sites. The agency said it would notify affected individuals and regulatory authorities, and provide fraud protection information. Separately, a December 2024 phishing incident is noted to have compromised IDHS employee accounts, exposing personal data of over 1.1 million people.