In April 2024, the Illinois Department of Human Services (IDHS) suffered an email phishing attack in which several employees were misled into sharing their credentials. The attacker accessed email accounts that included the public assistance account details of over 1.1 million clients, including the Social Security numbers of 4,701 clients.
Based on an IDHS media notification on December 20, 2024, the email accounts compromise happened on April 25, 2024. With the help of the Illinois Department of Innovation and Technology (DoIT), IDHS looked into the occurrence to determine the scope of the security breach and the people whose sensitive information was exposed. On May 3, 2024, IDHS confirmed that the incident was regarded as a reportable security breach under the Illinois Personal Information Protection Act (PIPA). The email accounts and related files analysis took a few months.
The analysis showed that the public assistance account data of 1,118,993 clients had been compromised, which included their names and public assistance account numbers together with a few or all of these data: Recipient ID Number, birth date, and mobile phone number.
Independently, IDHS stated that the Social Security numbers of 4,701 clients and 3 staff were included in compromised files. IDHS mailed notification letters to 2,918 people and sent email notices to the 3 impacted staff on November 21, 2024. The outstanding 1,783 people whose Social Security numbers were exposed were not sent notification letters because they were missing addresses on file. They were deemed notified through IDHS’ website and press notices.
According to PIPA, substitute data breach notices may be announced when the number of impacted persons is greater than 500,000 and the cost of sending notifications by mail is greater than $250,000. Because of the lower sensitivity of the compromised information for the 1,118,993 clients, substitute notices were released. IDHS stated it offers HIPAA training on security awareness including training on determining, reporting, and blocking phishing attempts, and will continue doing so.
