Years online, but no safeguards: How Illinois exposed 700,000 health records
The Illinois Department of Human Services (IDHS) has disclosed a massive data breach, which affects over 700,000 of its customers.
Image by Cybernews.
The Illinois Department of Human Services (IDHS) has disclosed a massive data breach, which affects over 700,000 of its customers.
According to a press release, on September 22nd, 2025, the agency discovered that one of its divisions had created planning maps on a mapping website containing personal and sensitive information of its customers and had posted the data on the internet, without enabling the correct privacy settings.
For obvious reasons, this information was intended for internal use only.
The agency discovered that these maps contained highly sensitive personal health information, including names, addresses, case numbers, status reports, demographic information, and the names of medical assistance plans.
The incident involved two categories of affected people: 32,401 Division of Rehabilitation Services (DRS) customers, and 672,616 Medicaid and Medicare Saving Programs Recipients, bringing the total number of affected customers to 705,017.
Information about DRS customers was publicly accessible from April 2021 through September 2025. The maps containing information about Medicaid and Medicare Saving Programs Recipients were publicly accessible from January 2022 through September 2025.
“Upon discovering this incident, IDHS immediately changed the privacy settings on all maps between September 22nd, 2025, and September 26th, 2025, to restrict access to only authorized IDHS employees,” the state agency says in a press release.
The IDHS has conducted a comprehensive investigation, but was unable to identify who viewed the maps.
In addition, the IDHS has developed and implemented a Secure Map Policy that prohibits the uploading of any customer-level data to public mapping websites and restricts access to customer-related maps to authorized personnel.
The health agency is in the process of notifying relevant regulatory authorities and affected customers. Lastly, the IDHS is working on additional measures to make sure this doesn’t happen again.
Unlock more exclusive Cybernews content on YouTube.