IDES User Sees Data Breach Exposing Social Security Numbers, Other Info

CHICAGO (CBS) -- Another hit for potentially thousands of people now out of work.

Gig workers personal information, including their addresses and Social Security numbers, were exposed.

And the woman who made the discovery, sent proof to CBS 2 Investigator Megan Hickey.

The provided screenshots showing private information easily accessible on the state's unemployment website. She said it's hard for her to believe that she was the only person to stumble across it.

"I just couldn't believe what I was seeing. Fifty plus pages," said the southern Illinois businesswoman who asked to remain anonymous. She couldn't believe what she found while clicking through the pandemic unemployment assistance, or PUA, online application on Friday.

Her Illinois State Representative Terri Bryant (R-Murphysboro) could hardly believe it either.

"Their claimant number, their name, their full Social Security number. I'd like to burn out of my brain the Social Security numbers that I saw," Bryant said.

Screenshots from the claimant show page after page of sensitive data. Representative Bryant said she informed Illinois Governor JB Pritzker's office of the breach by 1:00 Friday afternoon.

After more than a day, IDES hadn't acknowledged it.

"I waited 30 hours. By that point I felt like I had a responsibility not to wait any longer," Bryant said.

On Sunday night, IDES released a statement saying "one PUA claimant was able to inadvertently access the info and that it was corrected within an hour."

But the claimant disagreed.

"It definitely did not get taken care of in an hour. I know that for a fact," she said.

She said she was able to access the same spreadsheet well into the weekend. On Monday, Governor Pritzker had very little information when CBS 2 asked about the breach.

On  Monday, Pritzker reiterated that the firm Deloitte built the portal. IDES said Deloitte would be conducting additional testing to make sure that this kind of information is not accessible in the future.

CBS 2 reached out to Deloitte and the company sent this statement:

We are deeply committed to protecting the personal information of our clients and the people they serve. A unique circumstance enabled one Pandemic Unemployment Assistance claimant in Illinois to intermittently access a restricted page on the state's website. Within an hour of learning of this issue, we identified the cause and stopped the unauthorized access to prevent additional occurrences. The only person to inadvertently access the restricted page is the one who reported it. Out of an abundance of caution, we are providing credit monitoring to those potentially impacted by this issue.