The Illinois Department of Health has exposed the personal data of more than 700,000 residents for years

The Department of Health in the US state of Illinois confirmed that a security flaw that lasted for years exposed the personal information of more than 700,000 residents of the state.

The Illinois Department of Human Services (IDHS) said in Statement on January 2 An internal mapping website containing residents’ personal information, which officials used to help allocate state resources, was inadvertently publicly viewable from April 2021 until September 2025, when the vulnerability was discovered.

The exposed data included personal information about 672,616 individual Medicaid and Medicare Savings Program beneficiaries, officials said. The data included their addresses, case numbers and demographic data, but not the names of the individuals.

The exposed data also included the names, addresses, case statuses and other information related to 32,401 individuals receiving services from the department’s Rehabilitation Services Division.

IDHS said it was unable to determine whether anyone had viewed the publicly exposed maps during the four years they were accessible on the web.