Illinois Privacy Enforcement Cases

Why the action was brought

The 2023 credential-stuffing breach compromised data of 6.9 million customers worldwide, including nearly 200,000 Illinoisans, and exposed personal data and, in some cases, genetic ancestry information. Investigators alleged unreasonable security practices, including inadequate safeguards, rate limiting, monitoring, investigation of unusual logins, vulnerability remediation, and design-feature testing, causing data to reach the dark web.

Why the action was brought

Blackbaud’s software contained contact and demographic information, Social Security numbers, driver’s license numbers, financial, employment, wealth, donation, and protected health information. It allegedly failed to implement reasonable data security, remediate known security gaps, and provide customers timely, complete, accurate breach information, exposing millions of consumers and potentially confusing customers about notification duties.

Why the action was brought

The investigation concerned a criminal cyberattack publicly announced February 4, 2015, after attackers used malware delivered through phishing to access Anthem’s enterprise data warehouse. Unencrypted names, birth dates, Social Security numbers, healthcare identification numbers, addresses, email addresses, phone numbers, employment information, and income data of approximately 78.8 million people were accessed.