State agency published private data of nearly 32,500 unemployed Illinoisans

Just as Illinois opened its unemployment system to self-employed workers, the new system exposed Social Security numbers and other private information of 32,483 applicants, according to a Freedom of Information Act response.

The new state unemployment claims system exposed Social Security numbers and other private information of 32,483 individuals, according to the Illinois Department of Employment Security’s response to a Freedom of Information Act request.

Illinois Gov. J.B. Pritzker’s office first confirmed the data breach to WBEZ late on May 16 after a reporter was sent a screenshot of some private applicant information. No information about the number of exposed applicants was offered.

The number of affected applicants was contained in a response to an open records request provided to the Illinois Policy Institute.

Self-employed individuals, such as contractors and gig economy workers, do not pay into the unemployment system, so normally they would not be eligible for benefits. But they were included in the federal Pandemic Unemployment Assistance, or PUA, made available March 27, but Illinois did not get its application system online until May 11.

On that first day Illinoisans filed 44,000 jobless claims, Pritzker said. Pritzker spokeswoman Jordan Abudayyeh initially told WBEZ the number of people exposed by the new system was unknown.

IDES was “aware there was a glitch in the new PUA system that made some private information publicly available for a short time and worked to immediately remedy the situation,” Abudayyeh said in a statement.

The data breach was first noticed by a small business owner from southern Illinois, who was browsing the unemployment claims site to receive assistance herself. She brought it to the attention of state Rep. Terri Bryant, R-Murphysboro, who alerted the governor’s office May 15. Bryant’s constituent provided a screenshot showing the names, Social Security numbers and other claim information of applicants on a publicly accessible part of the site.

“It was 50 pages-plus. So we’re talking thousands of people,” the small-business owner recounted, speaking to WBEZ on the condition of anonymity. “This is insane.” IDES said the anonymous business owner was the only person to come forward claiming to have seen the private data posted publicly.

Since the stay-at-home order has gone into effect, the state’s unemployment system has been overwhelmed and struggled to keep up as more than 1 million workers sought benefits.

“The website is extremely complicated, and I can’t even imagine how some other people maneuver through it. I had a very difficult time,” said Marilyn Kline-Peacock, who owns a day care center in Carthage, Illinois. “It said, ‘You need to go back [now] and apply for unemployment.’ So I did that, and then of course I had to wait for a denial letter, which came a week or so later. Then I had to go apply on the other part. I have not heard anything.”

In late April, the state awarded Deloitte a $22 million no-bid contract to build the new claims system that could process previously excluded workers and to manage a call center.

“The computer system that was built to handle unemployment claims for our state was built in 2010 in the wake of the Great Recession, and it was built with the idea that unemployment would never really exceed what we saw in 2009,” Pritzker said on April 13. “But today we are seeing five times that number of claims.”

But even after waiting nearly two months to make claims, self-employed workers still found frustration, confusion and complications in navigating the state’s new system. Some were unable to reach assistance or troubleshoot by phone or chat, despite the state contracting out for additional phone banking services. Others were still unable to apply for benefits after being rejected for regular unemployment, as the system didn’t recognize them as qualified for the federal government’s expanded unemployment benefits.

“You can’t check the website,” Kline-Peacock said. “They provided a phone number to call. It glitches out, it disconnects you. I’ve been on the phone three days in a row for an hour straight on hold and then it just hangs up on me. I’ve waited and waited. There’s no help.”

Complaints and data breaches are not the only problems facing IDES: state funds are expected to run out by the end of May. Illinois already has been approved for a $5 billion federal loan to keep the unemployment benefits flowing, but is expected to borrow $11 billion and will eventually need to repay that amount.

IDES has a long history of fiscal mismanagement, failing to recover $115 million in erroneous payments last year and $450 million between 2012 and 2016. Audits have repeatedly found mismanagement, including allowing claims to go unanswered for more than two months.

Now in addition to offer grudging help to Illinoisans unemployed for nearly two months, IDES has added harm for 32,483 idled workers.