Illinois Notifies 700,000 of Misconfiguration Breach

The Illinois Department of Human Services is notifying more than 700,000 people of a breach involving “incorrect privacy settings” left in place for several years that exposed online data pertaining to Medicare, Medicaid and rehabilitation services recipients.

See Also: Using the Netskope HIPAA Mapping Guide

The state agency in a Jan. 2 statement said the incident, discovered on Sept. 22, 2025, involved exposure of maps created by the Division of Family and Community Services’ Bureau of Planning and Evaluation.

“The maps were created to assist IDHS with resource allocation decisions, such as determining where to open new local offices, and were intended for internal IDHS use only,” IDHS said.

The IDHS breach affects two categories of individuals.

That includes nearly 673,000 Medicaid and Medicare Savings Program recipients. The maps containing those individuals’ information were publicly accessible from January 2022 through September 2025. That affected information did not include recipients’ names, but did expose their addresses, case numbers, demographic information, and the name of medical assistance plans, such as Medicaid and Medicare.

The other category of individuals affected in the breach included about 32,401 division of rehabilitation services customers.

The maps containing DRS customer information were publicly accessible from April 2021 through September 2025 and included names, addresses, case numbers, case status, referral source information, region and office information, and status as DRS recipients.

The department said it is unable to identify who viewed the exposed map information. After discovering the exposure, IDHS said it immediately changed the privacy settings on all maps to restrict access to only authorized employees.

Since the incident, the department developed and implemented a “secure map policy” that prohibits the uploading of any customer-level data to public mapping websites.

IT misconfiguration incidents are a frequent problem in the healthcare sector that has led to many large breaches over the years. A variety of factors often contribute to IT misconfiguration mistakes that end up with months, or years-long exposures of health data to the web, said Keith Fricke, partner and principal consultant at security and privacy consultancy tw-Security.

“Several common reasons exist: poor or no formal change management processes that include confirming changes were implemented as expected, IT staff in a hurry to complete a change in order to move on to the next task in their to-do list, and possibly a lack of understanding of the appropriate configuration settings,” he said.

Misconfigurations also commonly occur when a system’s operating system or database technology is upgraded and unnecessary services and protocols that enabled by default are not removed or disabled, he said.

“A formal change management process should include a checklist to review the required security configuration settings are implemented,” he said. “Sometimes an upgrade or update to a system can revert security settings back to a default state less secure than desired. A good practice is having one person make the changes and another person check their work.”

“Separation of duties in this manner reduces the chances the person making changes has not overlooked something important.”

If a third-party vendor is responsible for making IT changes, the same change management principles apply, Fricke said. “The vendor must provide notification of what changes will be made, when, how, by whom and what their backout plan is. Additionally, the customer should test the system’s functionality after the changes, including a review of security settings to the extent possible.”