The Illinois Health Department exposed the personal data of more than 700,000 residents for years

The Department of Health in the US state of Illinois has confirmed that a years-old security breach exposed the personal information of more than 700,000 state residents.

The Illinois Department of Human Services (IDHS) stated in a statement on January 2 that an internal mapping website containing personal information about residents, which officials used to help allocate state resources, was inadvertently publicly accessible between April 2021 and September 2025, when the security breach was discovered.

Officials said the exposed data included personal information on 672,616 people who were beneficiaries of the Medicaid and Medicare savings programs. The data included their addresses, case numbers and demographics, but not the names of the individuals.

The exposed data also included the names, addresses, case statuses and other information relating to 32,401 individuals receiving services from the department’s Rehabilitation Services Division.

IDHS said it could not determine whether anyone had viewed the publicly displayed maps in the four years they were available on the web.