Endeavor Health Skokie Hospital data breach

What we know

Endeavor Health Skokie Hospital is a prominent healthcare institution serving communities across Illinois, delivering comprehensive medical services ranging from emergency care and specialized surgery to advanced diagnostic testing and outpatient treatments. Because of its core mission to heal and care for patients, the hospital system routinely collects, processes, and stores an extensive volume of highly sensitive personal and protected health information. This data includes everything required to coordinate patient care, submit medical insurance claims, and maintain detailed clinical histories, making the institution a repository of some of the most private information an individual can possess. In 2025, a significant security incident affecting Endeavor Health Skokie Hospital was officially reported to the Illinois Attorney General, thrusting patients and staff into the unsettling position of having their confidential data compromised. While exact technical investigations often unfold over many months, security breaches impacting large medical providers frequently involve sophisticated cyberattacks, unauthorized network intrusions, ransomware deployments, or vulnerabilities within third-party vendor systems that handle digital infrastructure. In the healthcare sector, malicious actors specifically target administrative databases and Electronic Health Record systems precisely because medical data commands high value on the underground market and can be exploited for numerous illicit purposes. The unauthorized exposure resulting from this breach likely laid bare a devastating combination of sensitive data fields, including full names, dates of birth, Social Security numbers, medical record numbers, health insurance policy details, diagnostic and treatment information, and prescription records. The compromise of clinical and diagnostic details creates immediate and severe risks, opening victims up to medical identity theft where criminals obtain unauthorized care using another person's insurance, or where fraudulent medical bills are generated in the victim's name. Furthermore, when immutable identifiers like Social Security numbers and dates of birth are exposed alongside medical profiles, victims face lifelong threats of financial fraud, tax identity theft, and unauthorized account takeovers that can disrupt their financial and personal lives for years. Endeavor Health Skokie Hospital was bound by stringent legal and regulatory frameworks, most notably the Health Insurance Portability and Accountability Act (HIPAA), as well as state-level data protection and consumer protection statutes. Under HIPAA and related Illinois privacy laws, healthcare providers are legally mandated to implement robust administrative, physical, and technical safeguards to secure electronic protected health information against unauthorized access, theft, or disclosure. The occurrence of a widespread data breach strongly suggests a systemic failure of these foundational security obligations, raising serious questions about whether the hospital maintained adequate encryption, timely security patch management, and rigorous access controls necessary to shield confidential patient records from evolving cyber threats. For patients and personnel who have received an official data breach notification letter from Endeavor Health Skokie Hospital, this document serves as a formal legal admission that their private information was compromised due to inadequate institutional safeguards. Legally, receiving this notice establishes standing to participate in a class action lawsuit aimed at holding the healthcare provider accountable for its security lapses. Importantly, affected individuals do not need to prove that they have already suffered actual financial loss or medical fraud to seek legal redress; the increased risk of future harm alone is enough to take action. Our law firm is investigating this breach on a contingency fee basis, meaning there are never any out-of-pocket costs or upfront fees, and we only collect a fee if we successfully recover compensation on your behalf.

See every breach reported in Illinois or read what to do after a ransomware attack.