Illinois Department of Human Services tightens map security after data incident
ILLINOIS — The Illinois Department of Human Services is notifying the public of a data security incident involving internal planning maps that were mistakenly made public from due to incorrect privacy settings.
The maps were used for internal resource planning and created on a mapping website.
The data included information related to some individuals in the Division of Rehabilitation Services and recipients of the Medicaid and Medicare Savings Program.
Approximately 32,401 Division of Rehabilitation Services customers were impacted.
The maps containing DRS customer information were publicly accessible from April 2021 through September 2025.
The information involved includes: names, addresses, case numbers, case status, referral source information, region and office information, and status as DRS recipients.
Approximately 672,616 Medicaid and Medicare Savings Program recipients were impacted.
The MMSP maps containing user information were publicly accessible from January 2022 through September 2025.
The information involved includes: addresses, case numbers, demographic information, and the name of medical assistance plans (such as Medicaid, Medicare, etc.). The information did not include recipients’ names.
The IDHS is not aware of any information misuse at this time.
The issues were discovered on September 22 of 2025.
Upon discovery, the map access was immediately limited, a new secure map policy was implemented, and IDHS is still in the process of sending notice to the individuals affected by this incident.
The new IDHS Secure Map Policy prohibits the uploading of any customer-level data to public mapping websites.
The notices being sent to affected customers will include toll-free numbers where customers can call for additional information.
Credit reporting agencies and the Federal Trade Commission can also offer information fraud alerts and security freezes and information for those organizations is being provided to the affected individuals.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
