Illinois Department of Human Services Plagued by Repeated Data Breaches: FOIA Documents Expose Vulnerabilities Affecting Hundreds of Thousands

Illinois Department of Human Services Plagued by Repeated Data Breaches: FOIA Documents Expose Vulnerabilities Affecting Hundreds of Thousands

By Rockford Scanner Staff February 5, 2026 – Rockford, IL
Sources:  James E Ferguson Jr & Freedom Of Information Act 

In a revelation that underscores ongoing challenges in safeguarding sensitive personal information within Illinois' public welfare systems, newly released documents obtained through a Freedom of Information Act (FOIA) request paint a troubling picture of repeated data breaches at the Illinois Department of Human Services (IDHS).

The records, spanning from 2017 to 2025, detail incidents ranging from physical mishandling of files to sophisticated phishing attacks and prolonged online exposures of protected health information (PHI). These breaches have collectively impacted over 700,000 Illinois residents, including vulnerable populations reliant on Medicaid, Medicare Savings Programs, and rehabilitation services.

The documents were released by the Office of the Illinois Attorney General (OAG) in response to a FOIA request filed by Rockford resident James Earl Ferguson Jr. on January 20, 2026. Ferguson sought records from January 1, 2015, to the present concerning data exposures, internal investigations, HIPAA compliance reviews, notifications to affected individuals, and remedial actions—specifically referencing his own information and that of his dependents. After an initial denial and a subsequent review request from Ferguson on January 29, 2026, the OAG conducted a broader search.

In a February 5, 2026, letter signed by Assistant Attorney General James M. Gale, the office stated it found no records specifically identifying Ferguson or his family. However, it partially granted the request by providing redacted documents related to general data breaches, withholding only "private information" such as signatures under FOIA exemptions.

The released files, primarily breach notifications submitted by IDHS to the OAG under the Illinois Personal Information Protection Act (PIPA), highlight a pattern of systemic issues. From dumpster dives to digital misconfigurations, the incidents reveal gaps in employee training, system security, and third-party oversight. While IDHS has implemented corrective measures in each case, critics argue these reactive steps fail to address root causes, leaving residents—particularly in underserved areas like Rockford—at risk of identity theft, medical fraud, and privacy violations.

A Chronology of Breaches: From Physical Lapses to Digital Exposures

The earliest incident detailed in the FOIA response dates back to 2017, involving a contractor's egregious mishandling of physical records. On October 24, 2017, files belonging to 1,200 IDHS customers were discovered in an unsecured dumpster near a local office. These files, managed by United Chicago Services, Inc.—a provider contracted for employment services in IDHS's Family and Community Services (FCS) Division—contained sensitive customer information. IDHS's investigation concluded that the files were improperly removed from the provider's financial office and discarded. Although it's unknown if anyone viewed the contents, IDHS notified affected individuals on December 15, 2017, and pledged to enforce stricter record security protocols with the contractor. Patricia Brown, IDHS's Chief Privacy Officer at the time, emphasized in a December 21, 2017, letter to then-Attorney General Lisa Madigan that the agency would "take all action necessary" to prevent future occurrences.

Fast-forward to 2020, amid the height of the COVID-19 pandemic, when a coding error in the state's Integrated Eligibility System (IES) exposed data through its Application for Benefits Eligibility (ABE) component. Discovered on July 9, 2020, the breach affected 285 Illinois residents applying for Pandemic Supplemental Nutrition Assistance for Children Receiving Free or Reduced School Lunches (P-EBT). Due to the glitch, applications from 97 system users became viewable by others, potentially revealing names, addresses, telephone numbers, dates of birth, genders, school districts, school names, and Social Security Numbers (SSNs)—though SSNs were optional on the form.

The Illinois Department of Healthcare and Family Services (HFS) and the Department of Innovation and Technology (DoIT) collaborated with IDHS to shut down ABE immediately and remediate the issue. Notifications were mailed to affected individuals on July 31, 2020. In an August 11, 2020, joint report to Attorney General Kwame Raoul, IDHS Secretary Grace B. Hou and HFS Director Theresa Eagleson stressed the "paramount importance" of customer privacy, noting that the departments were "working together to ensure this does not happen again."

The pattern continued into 2025 with smaller but no less concerning breaches. On February 25, 2025, an IDHS employee fell victim to a phishing email from a hacked external account, granting a hacker brief access to their email inbox. The intruder set up rules to hide messages, sent additional phishing emails, and accessed inbox contents, compromising the medical information and SSNs of eight Illinois residents. Classified as a government agency breach, the incident was halted within an hour by DoIT, which revoked the hacker's access. Remedial actions included mandating multi-factor authentication (MFA) for all logins, disabling insecure web settings, implementing email filters, and adding real-time monitoring. Rachel Diamond, an Associate General Counsel for IDHS, reported the breach to the OAG and the U.S. Department of Health and Human Services (HHS) on May 5, 2025, with direct notices sent to affected residents on April 30, 2025.

Just weeks later, on March 11, 2025, a clerical error in the IES system led to a newborn's information being added to the wrong household case. A doctor's newborn report, submitted on February 19, 2025, contained incorrect case details, resulting in a Notice of Decision for Medicaid eligibility being mailed to the unintended recipient. The error was corrected swiftly after the incorrect household head notified IDHS, and the newborn was reassigned to the proper account. This breach affected only one resident's medical information. Diamond again handled the reporting, notifying affected parties on June 10, 2025, and HHS on June 25, 2025.

The most alarming revelation in the FOIA documents is a massive, long-term exposure discovered on September 22, 2025, affecting an estimated 705,017 Illinois residents. Six internal planning maps on the ESRI/ArcGIS platform had incorrect privacy settings, allowing public access from as early as April 2021. The maps exposed PHI from IDHS's Department of Rehabilitation Services (DRS) for 32,401 customers—including names, addresses, and medical referral data—starting in April 2021. Additionally, Medicaid and Medicare PHI for 672,616 individuals, such as addresses, case numbers, and plan information, was accessible from January 2022 onward.

IDHS responded by restricting access to authorized employees between September 22 and 26, 2025, conducting a comprehensive review, and enacting a new policy prohibiting customer data on public mapping sites. Thomas Mulcrone, IDHS's Deputy General Counsel, detailed these steps in the breach report, with notifications sent on January 8, 2026—the same day as the OAG's FOIA response. The breach, which ended on September 26, 2025, was not reported to law enforcement but was flagged to HHS on January 9, 2026.

Implications for Illinois Residents and Systemic Failures

These incidents collectively expose vulnerabilities in IDHS's handling of sensitive data, which serves millions through programs like Medicaid (covering over 3 million Illinoisans) and rehabilitation services for individuals with disabilities. Rockford, home to Ferguson and a significant number of low-income families reliant on these programs, has been particularly affected; local advocates note that breaches like the 2025 mapping exposure could disproportionately impact rural and urban underserved communities, where access to credit monitoring or legal recourse is limited.

Experts point to recurring themes: human error (phishing, misfiling), technical glitches (coding errors, privacy settings), and inadequate third-party oversight (the 2017 dumpster incident). While IDHS has consistently reported breaches to the OAG and HHS as required by PIPA and HIPAA, and implemented fixes like enhanced MFA and policy changes, the sheer scale—especially the 705,017 affected in the mapping breach—raises questions about proactive auditing and investment in cybersecurity. The OAG's FOIA response notes that no records of internal investigations, audits, or HIPAA reviews specific to Ferguson's request were found within their office, suggesting such documents may reside with IDHS itself.

Ferguson, in his January 29 review request, argued that the OAG's initial denial was "inconsistent with publicly acknowledged facts," referencing IDHS's admission of exposing over 700,000 residents' data from 2021 to 2025. His persistence led to the partial release, but the absence of personalized records leaves open whether his family's data was compromised in any of these events.

As Illinois grapples with digital transformation in public services, these FOIA documents serve as a stark reminder of the human cost of data insecurity. Residents affected by these breaches are encouraged to monitor their credit reports and contact IDHS's HIPAA office at This email address is being protected from spambots. You need JavaScript enabled to view it. for support. The OAG has advised that Ferguson can appeal the partial denial to their Public Access Counselor within 60 days or seek judicial review.

This story is based solely on the facts contained in the released FOIA documents. Rockford Scanner will continue monitoring for updates on data privacy in state agencies.

In the mood to read some creepy local stories? 
CLICK HERE TO BE SCARED! 
Enter at your own risk! 18+
Don't say we did not warn you... 
😨