Illinois DHS Public Maps 2025 Data Breach
The Illinois DHS Public Maps 2025 data breach occurred when internal planning maps created by the Illinois Department of Human Services were viewable on a public mapping website because of incorrect privacy settings.
Exposed Data Types
2 sensitive10- Medical assistance plan names
- Protected health information
- Names
- Physical addresses
- Case numbers
- Case statuses
- Referral sources
- Regional and office information
- Recipient status
- Demographic information
About This Breach
The agency discovered the issue on 22 September 2025 and restricted the relevant maps to authorized employees by 26 September. Because the mapping site could not identify historical viewers, public exposure is confirmed, but no specific attacker, download, or misuse has been established.
IDHS reports two approximate groups: 32,401 Division of Rehabilitation Services customers and 672,616 Medicaid or Medicare Savings Program recipients. Their arithmetic sum is 705,017. The agency does not state whether any person appeared in both groups or describe a final deduplication method, so this is not an exact unique-person total; it is used as the approximate sum of the two reported category counts.
Which groups and information may have been involved?
Maps involving approximately 32,401 DRS customers were accessible from April 2021 through September 2025 and contained names, addresses, case numbers, case status, referral sources, regional and office information, and status as a DRS recipient. Maps involving approximately 672,616 Medicaid and Medicare Savings Program recipients were public from January 2022 through September 2025 and contained addresses, case numbers, demographic information, and medical-assistance plan names, but not recipient names. Fields differed by group, and the combined list did not apply to every record.
Organization response, privacy boundary, and safe next steps
IDHS said it implemented a Secure Map Policy prohibiting customer-level data on public mapping platforms and restricted access by job role. At the official notice date, it was not aware of actual or attempted misuse of personal information connected to the incident. Notice recipients should rely on the group and fields in their letter and verify unfamiliar benefit-program, case, or health-plan messages through the agency's current official channel. Viewing this page or finding a record does not establish that a particular person received rehabilitation, Medicaid, Medicare, or another IDHS service; that inference should not be shared or used against anyone.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
