Breaches and incidentsBriefReported by a reputable outlet, citing the company
Illinois Department of Human Services: misconfigured mapping site exposed 705,000 Medicaid and rehabilitation clients for up to four years
IDHS found on about 22 Sep 2025 that an internal-only mapping website was publicly accessible.
- Disclosed
What happened
- IDHS found on about 22 Sep 2025 that an internal-only mapping website was publicly accessible; planning maps exposed addresses, case numbers, demographics and plan names of 672,616 Medicaid/MSP recipients (Jan 2022 to Sep 2025) and names, addresses and case details of 32,401 rehabilitation services customers (Apr 2021 to Sep 2025). Reported to HHS OCR as 705,017, the largest breach reported in Jan 2026 (HIPAA Journal).
- Root cause: privacy settings misconfigured by the Bureau of Planning and Evaluation on a public mapping platform.
- Attacker: none identified; IDHS could not determine who viewed the maps.
- Response: settings fixed 22 to 26 Sep 2025; new Secure Map Policy bans customer-level data on public mapping sites.
Sources
- https://www.hipaajournal.com/illinois-department-of-human-services-data-breach-2025/
- https://www.hipaajournal.com/january-2026-healthcare-data-breach-report/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.