Heart Care Centers of Illinois data breach: one mailbox phished in 2024, found in 2026

What happened at Heart Care Centers of Illinois?

HCCI's website notice, dated July 18, 2026, gives the timeline the mailed letter leaves out. On January 15, 2026, while looking into a phishing attempt that had failed, HCCI found older suspicious activity in an employee's email account. Forensic specialists then found that an earlier phishing attack had succeeded, and that the account had been open to the outsider for about two and a half months in 2024. A data analytics firm reviewed the mailbox to learn what it held and whose data it was, and finished on June 11, 2026.

Date	What happened	Source
August 22, 2024	Outsider's access to the employee mailbox begins	HCCI notice; Indiana report
November 6, 2024	Access ends	HCCI notice
January 15, 2026	HCCI finds the old activity while investigating a failed phishing attempt	HCCI notice
June 11, 2026	Mailbox review finished	HCCI notice
July 10, 2026	Letters begin; report to HHS (52,562); Indiana notice (14 residents)	HCCI notice; HHS; Indiana report
July 18, 2026	Website notice posted	HCCI notice
August 24, 2026	Logged in Massachusetts (2 residents)	Massachusetts report
October 31, 2026	Enrollment deadline for the free monitoring	HCCI notice

The letters went out 687 days after the access began. Most of that gap is the 14 months before HCCI found the activity; the mailbox review then took almost five months more. The notice-delay guide shows how that compares.

What information was involved?

It varies by person. The mailed letter filed in Massachusetts names only name and Social Security number, but the website notice gives the full list for the incident. It covers name, mailing address, Social Security number, date of birth, driver's license or state ID number, payment card and financial account numbers, passport number, and medical, prescription, health insurance and provider information. The people involved are both employees and patients. HCCI says it has no reason to believe there has been identity theft, fraud or misuse. It says it is reviewing its policies and security measures.

What is HCCI offering?

Item	Detail from the letter
Service	24 months of credit monitoring and identity restoration (1-bureau monitoring with alerts, a credit score and report, Social Security number monitoring)
Provider	Epiq Privacy Solutions ID
Enrollment	www.privacysolutionsid.com, with the code printed on the letter; help on 866.675.2006, Monday to Friday, 9:00 a.m. to 5:30 p.m. ET
Questions	888-616-9388, Monday to Friday, 8 a.m. to 8 p.m. Central Time, excluding U.S. holidays

The website notice says the enrollment deadline was October 31, 2026, so the offer has now closed; call center agents enrolled people by phone until then. A credit freeze, free at each of the three bureaus, has no deadline. The guide to credit monitoring offers sets Heart Care Centers of Illinois' offer beside other letters.

What the documents leave open

• Why the 2024 access went unnoticed for 14 months.
• How many of the 52,562 are employees and how many are patients.
• Which data elements each person's letter lists; the mailed letter on file names only two.

With 52,562 people, Heart Care Centers of Illinois' report is the 74th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.