Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with yes, and third party assistance with state department of innovation and technology, and containment measures with malicious link blocking, employee password resets, and communication strategy with data breach notification to affected individuals, and containment measures with immediate change of privacy settings to restrict access to authorized idhs employees, and remediation measures with implementation of a secure map policy prohibiting upload of customer data to public mapping websites, and communication strategy with notices sent to affected individuals with a phone number for more information..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Hacked government email account.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally Identifiable Information (PII), Financial Information, Personally Identifiable Information (PII), Case Information, Demographic Information and Medical Assistance Plan Names.

Incident Response Plan: The company's incident response plan is described as Yes.

Third-Party Assistance: The company involves third-party assistance in incident response through State Department of Innovation and Technology.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Implementation of a secure map policy prohibiting upload of customer data to public mapping websites.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by malicious link blocking, employee password resets and immediate change of privacy settings to restrict access to authorized idhs employees.

Key Lessons Learned: The key lessons learned from past incidents are Importance of proper privacy settings and secure data handling policies for public-facing tools.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Regular audits of privacy settings, employee training on data security, and stricter controls on public data uploads and Impacted individuals urged to track credit reports and enable fraud alerts to avert potential malicious activity..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: CyberRisk Alliance, and Source: Illinois Department of Human Services StatementDate Accessed: 2025-09-26.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Data breach notification to affected individuals and Notices sent to affected individuals with a phone number for more information.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Affected individuals notified and advised to monitor credit reports and enable fraud alerts. and Notices sent to affected individuals with a phone number for more information.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as State Department of Innovation and Technology.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Malicious link blocking, password resets, collaboration with state Department of Innovation and Technology, Implementation of secure map policy and restricted access to authorized employees.

Most Recent Incident Detected: The most recent incident detected was on 2024-02.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-09-26.

Most Recent Incident Resolved: The most recent incident resolved was on 2025-09-22.

Most Significant Data Compromised: The most significant data compromised in an incident were Names, birthdates, driver's license and state ID numbers, Social Security numbers, child support- or Medicaid-related financial details, Names, addresses, case numbers, case status, referral source information, region and office information, demographic information and medical assistance plan names.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was State Department of Innovation and Technology.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Malicious link blocking, employee password resets and Immediate change of privacy settings to restrict access to authorized IDHS employees.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Names, addresses, case numbers, case status, referral source information, region and office information, demographic information, medical assistance plan names, Names, birthdates, driver's license and state ID numbers, Social Security numbers and child support- or Medicaid-related financial details.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 702.9K.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Importance of proper privacy settings and secure data handling policies for public-facing tools.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Regular audits of privacy settings, employee training on data security, and stricter controls on public data uploads and Impacted individuals urged to track credit reports and enable fraud alerts to avert potential malicious activity..

Most Recent Source: The most recent source of information about an incident are Illinois Department of Human Services Statement and CyberRisk Alliance.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Most Recent Customer Advisory: The most recent customer advisory issued were an Affected individuals notified and advised to monitor credit reports and enable fraud alerts. and Notices sent to affected individuals with a phone number for more information.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Hacked government email account.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Phishing attack leading to unauthorized access to employee email account, Incorrect privacy settings on public mapping tools.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Malicious link blocking, password resets, collaboration with state Department of Innovation and Technology, Implementation of secure map policy and restricted access to authorized employees.