Illinois Department of Human Services Phishing Attack Impacts 1.1 Million Customers
Earlier this year, an email phishing attack on the Illinois Department of Human Services (IDHS) saw multiple employees tricked into disclosing their credentials. The threat actor was able to access email accounts that contained the public assistance account information of more than 1.1 million customers, including the Social Security numbers of 4,701 customers.
According to an IDHS media notice on December 20, 2024, the email accounts were compromised on April 25, 2024. Assisted by the Illinois Department of Innovation and Technology (DoIT), IDHS investigated the incident to determine the extent of the data breach and the individuals who had sensitive data exposed. On May 3, 2024, IDHS determined the incident was a reportable data breach under the Illinois Personal Information Protection Act (PIPA); however, it took several months to analyze the email accounts and associated files.
The analysis revealed 1,118,993 customers had public assistance account information compromised, including their name and public assistance account number in combination with some or all of the following: address, date of birth, Illinois State Board of Education Student Information System ID number, Recipient Identification Number, and cell phone number.
Separately, IDHS reports that the Social Security numbers of 4,701 customers and 3 employees were contained in exposed files. Individual notification letters were mailed to 2,918 individuals on October 31, 2024 , and email notices were sent to the 3 affected employees on November 21, 2024. The remaining 1,783 individuals who had their Social Security numbers exposed could not be notified by mail due to a lack of an address on file and were considered notified via the website and media notices.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Under PIPA, substitute data breach notices can be issued when the number of affected individuals exceeds 500,000 and the cost of mailing notifications exceeds $250,000. Due to the lower sensitivity of the exposed data for the 1,118,993 customers, substitute notices were issued. IDHS said it provides security awareness training to its employees that includes training on how to identify, report, and avoid phishing attempts, and will continue to do so.
