Illinois Department of Human Services Exposes Health Data of Over 700,000 Individuals for Over Three Years The Illinois Department of Human Services (IDHS) recently disclosed a data breach involving the protected health information (PHI) of more than 705,000 individuals, which remained publicly accessible on a mapping website for over three years. The breach affected two groups: approximately 32,401 customers of the Division of Rehabilitation Services (DRS) and 672,600 recipients of the Medicaid and Medicare Savings Program. The exposed data, uploaded to a public mapping platform used by IDHS’s Bureau of Planning and Evaluation, was intended for internal resource allocation purposes. Due to incorrect privacy settings, the information was viewable to the public from April 2021 to September 2025 for DRS customers and from January 2022 to September 2025 for Medicare Savings Program recipients. The breach included sensitive details such as names, addresses, case numbers, and demographic information, though Medicare recipients’ names were not exposed. IDHS discovered the vulnerability on September 22, 2025, and immediately restricted access to authorized personnel. However, the agency failed to meet federal HIPAA requirements, which mandate notification of affected individuals and media outlets within 60 days of discovery. Instead, IDHS issued a public statement on January 2, 2026 102 days after identifying the breach. When questioned about the delayed discovery and notification, IDHS declined to provide an explanation, stating only that customer privacy was a priority and that corrective measures, including a new Secure Map Policy, had been implemented to prevent future incidents. The policy now prohibits the upload of identifiable customer data to public mapping platforms.

Illinois Health Agency Reports Phishing Attack Exposing Sensitive Data In February, the Illinois Department of Healthcare and Family Services (HFS) disclosed a data breach affecting 933 individuals—564 of whom are state residents—after a phishing attack compromised an employee email account. Threat actors gained access by sending malicious emails from a previously hacked government account, enabling the exfiltration of personal data, including names, birthdates, driver’s license and state ID numbers, Social Security numbers, and financial details related to child support or Medicaid. HFS responded by blocking malicious links, resetting employee passwords, and collaborating with the state Department of Innovation and Technology to contain the breach. While no evidence of misuse has been reported, affected individuals were advised to monitor credit reports and set up fraud alerts. The incident highlights ongoing cybersecurity risks in government systems, particularly through phishing and supply chain vulnerabilities. Separately, U.S. and Australian authorities have issued warnings about active exploitation of the "MongoBleed" vulnerability in MongoDB, with concerns that advanced persistent threats (APTs) may target critical infrastructure sectors, including energy, water, and transportation.

Illinois Department of Human Services Suffers Major Data Breach Affecting 705,017 Individuals The Illinois Department of Human Services (IDHS) disclosed a significant data breach impacting 705,017 individuals across the U.S. The incident, which occurred between April 2023 and September 2025, was discovered on September 22, 2025, and linked to a distributed denial-of-service (DDoS) attack claimed by the hacking group Red Wolf Cyber. The breach exposed sensitive information, including names, addresses, case numbers, case statuses, referral sources, regional office details, and protected health information (PHI) related to IDHS services. While Social Security numbers and financial data were not compromised, the leaked personally identifiable information (PII) and PHI pose privacy risks for affected individuals. Red Wolf Cyber first publicized the breach on the dark web on September 28, 2025, providing evidence of service disruptions. The U.S. Department of Health and Human Services was officially notified on January 9, 2026, and IDHS later posted a public notice on its website. In response, IDHS took steps to mitigate the incident and inform those impacted. The agency emphasized that the breach stemmed from a DDoS attack rather than a direct database compromise, though the exposed data could still be exploited for phishing or fraud. Affected individuals were advised to monitor accounts linked to IDHS services for suspicious activity.