{"id":71419,"date":"2025-06-06T18:57:47","date_gmt":"2025-06-06T22:57:47","guid":{"rendered":"https:\/\/statescoop.com\/?p=71419"},"modified":"2025-06-06T18:57:48","modified_gmt":"2025-06-06T22:57:48","slug":"illinois-health-dept-phishing-data-cyberattack","status":"publish","type":"post","link":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/","title":{"rendered":"February phishing campaign compromised Illinois health data, department says"},"content":{"rendered":"\n<p>The Illinois Department of Healthcare and Family Services on Friday announced a data breach resulting from a phishing attack earlier this year that compromised the personal information of 933 people, including 564 Illinois residents.<\/p>\n\n\n\n<p>According to the <a href=\"https:\/\/www.illinois.gov\/content\/dam\/soi\/en\/web\/illinois\/iisnewsattachments\/31387-060625-phishing-breach-media-notification.pdf.pdf\">notice<\/a>, HFS discovered the phishing campaign targeting its employees on Feb. 11. The department claims the attacker used a previously compromised government email account to send deceptive emails, leading to the unauthorized access of one employee&#8217;s emails and documents.<\/p>\n\n\n\n<p>&#8220;The bad actor sent emails to HFS employees from another government email account the bad actor had previously hacked, so that the emails looked trustworthy to HFS employees. As a result of these actions, one HFS employee\u2019s emails and documents were compromised,&#8221; the notice reads.<\/p>\n\n\n\n<p>The compromised information varied among individuals but may have included names, Social Security numbers, driver&#8217;s license or state ID numbers, financial details related to child support, Medicaid or child support case numbers and dates of birth.<\/p>\n\n\n\n<p>Upon discovering the breach, the department said, it worked with the Illinois Department of Innovation and Technology, now led by state Chief Information Officer <a href=\"https:\/\/statescoop.com\/illinois-pritzker-brandon-ragle-cio\/\">Brandon Ragle<\/a>, to block malicious links and reset potentially affected employee passwords. The department also issued training materials to all employees on how to recognize and respond to phishing attempts.<\/p>\n\n\n\n<p>HFS said it completed its notification to affected individuals on May 23, and advised them to monitor their credit reports and consider placing fraud alerts or security freezes on their accounts.<\/p>\n\n\n\n<p>The incident underscores the ongoing cybersecurity challenges faced by state agencies. Last April, a separate phishing attack on the <a href=\"https:\/\/idhs.prezly.com\/notice-to-media-from-illinois-department-of-human-services-incident-involving-protected-personal-information\">Illinois Department of Human Services<\/a> exposed the personal data of more than one million people, including approximately 4,700 Social Security numbers. That same month, bad actors compromised two email accounts at the Illinois <a href=\"https:\/\/statescoop.com\/phishing-attack-illinois-secretary-state-2024\/\">Secretary of State\u2019s office<\/a>, which may have exposed sensitive data such Social Security numbers and driver\u2019s license information.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A February 11 cyberattack compromised the health data of nearly 1,000 people, announced the Illinois Department of Healthcare and Family Services.<\/p>\n","protected":false},"author":614,"featured_media":71424,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[20646],"tags":[5606,16536,16537,25664,25665],"people":[],"special-report":[],"authors":[24250],"class_list":["post-71419","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-health-department","tag-cybersecurity","tag-cyberattack","tag-phishing-campaign","tag-illinois-health-data","author-sophia-fox-sowell"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.5 (Yoast SEO v24.5) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>February phishing campaign compromised Illinois health data, department says | StateScoop<\/title>\n<meta name=\"description\" content=\"A February 11 cyberattack compromised the health data of nearly 1,000 people, announced the Illinois Department of Healthcare and Family Services.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"February phishing campaign compromised Illinois health data, department says | StateScoop\" \/>\n<meta property=\"og:description\" content=\"A February 11 cyberattack compromised the health data of nearly 1,000 people, announced the Illinois Department of Healthcare and Family Services.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-06-06T22:57:47+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-06T22:57:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1300\" \/>\n\t<meta property=\"og:image:height\" content=\"867\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"sfoxsowell\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@State_Scoop\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/\",\"url\":\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/\",\"name\":\"February phishing campaign compromised Illinois health data, department says | StateScoop\",\"isPartOf\":{\"@id\":\"https:\/\/statescoop.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg\",\"datePublished\":\"2025-06-06T22:57:47+00:00\",\"dateModified\":\"2025-06-06T22:57:48+00:00\",\"description\":\"A February 11 cyberattack compromised the health data of nearly 1,000 people, announced the Illinois Department of Healthcare and Family Services.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/#primaryimage\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg\",\"width\":1300,\"height\":867,\"caption\":\"(Getty Images)\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/statescoop.com\/#website\",\"url\":\"https:\/\/statescoop.com\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\/\/statescoop.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/statescoop.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/statescoop.com\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\/\/statescoop.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/StateScoop\/\",\"https:\/\/x.com\/State_Scoop\",\"https:\/\/www.linkedin.com\/company\/statescoop\/\",\"https:\/\/www.youtube.com\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"February phishing campaign compromised Illinois health data, department says | StateScoop","description":"A February 11 cyberattack compromised the health data of nearly 1,000 people, announced the Illinois Department of Healthcare and Family Services.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/","og_locale":"en_US","og_type":"article","og_title":"February phishing campaign compromised Illinois health data, department says | StateScoop","og_description":"A February 11 cyberattack compromised the health data of nearly 1,000 people, announced the Illinois Department of Healthcare and Family Services.","og_url":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2025-06-06T22:57:47+00:00","article_modified_time":"2025-06-06T22:57:48+00:00","og_image":[{"width":1300,"height":867,"url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg","type":"image\/jpeg"}],"author":"sfoxsowell","twitter_card":"summary_large_image","twitter_creator":"@State_Scoop","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/","url":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/","name":"February phishing campaign compromised Illinois health data, department says | StateScoop","isPartOf":{"@id":"https:\/\/statescoop.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/#primaryimage"},"image":{"@id":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/#primaryimage"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg","datePublished":"2025-06-06T22:57:47+00:00","dateModified":"2025-06-06T22:57:48+00:00","description":"A February 11 cyberattack compromised the health data of nearly 1,000 people, announced the Illinois Department of Healthcare and Family Services.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/#primaryimage","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg","width":1300,"height":867,"caption":"(Getty Images)"},{"@type":"WebSite","@id":"https:\/\/statescoop.com\/#website","url":"https:\/\/statescoop.com\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/statescoop.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/statescoop.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/statescoop.com\/#organization","name":"StateScoop","url":"https:\/\/statescoop.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"February phishing campaign compromised Illinois health data, department says","url":"http:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/statescoop.com\/illinois-health-dept-phishing-data-cyberattack\/"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg"},"articleSection":"Cybersecurity","author":[{"@type":"Person","name":"Sophia Fox-Sowell","url":"https:\/\/statescoop.com\/author\/sophia-fox-sowell\/"}],"creator":["Sophia Fox-Sowell"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["cyberattack","cybersecurity","health department","illinois health data","phishing campaign"],"dateCreated":"2025-06-06T22:57:47Z","datePublished":"2025-06-06T22:57:47Z","dateModified":"2025-06-06T22:57:48Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"February phishing campaign compromised Illinois health data, department says\",\"url\":\"http:\\\/\\\/statescoop.com\\\/illinois-health-dept-phishing-data-cyberattack\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/statescoop.com\\\/illinois-health-dept-phishing-data-cyberattack\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/06\\\/GettyImages-954027800.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2025\\\/06\\\/GettyImages-954027800.jpg\"},\"articleSection\":\"Cybersecurity\",\"author\":[{\"@type\":\"Person\",\"name\":\"Sophia Fox-Sowell\",\"url\":\"https:\\\/\\\/statescoop.com\\\/author\\\/sophia-fox-sowell\\\/\"}],\"creator\":[\"Sophia Fox-Sowell\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"cyberattack\",\"cybersecurity\",\"health department\",\"illinois health data\",\"phishing campaign\"],\"dateCreated\":\"2025-06-06T22:57:47Z\",\"datePublished\":\"2025-06-06T22:57:47Z\",\"dateModified\":\"2025-06-06T22:57:48Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/statescoop.com\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2025\/06\/GettyImages-954027800.jpg","distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/statescoop.com","push-errors":false,"_links":{"self":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/71419","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/users\/614"}],"replies":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/comments?post=71419"}],"version-history":[{"count":2,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/71419\/revisions"}],"predecessor-version":[{"id":71425,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/71419\/revisions\/71425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media\/71424"}],"wp:attachment":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media?parent=71419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/categories?post=71419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/tags?post=71419"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/people?post=71419"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/special-report?post=71419"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/authors?post=71419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}