State Blames Fraudsters, Takes Action After At Least 16 People Are Affected By IDES Social Security Breach

CHICAGO (CBS) -- We've been telling you for two days now about the Illinois Department of Employment Security sending out random names and Social Security numbers to strangers.

On Wednesday night, the State of Illinois thanked us for flagging the problem - and is blaming fraudsters. The state said it is also taking immediate action to make sure it can never happen again.

And it didn't just happen once. CBS 2 has been digging into why the state's unemployment agency would send the crown jewel of a person's identity to complete strangers.

Last week, a man was mailed by the State of Illinois the names and Social Security numbers of 11 strangers. And CBS 2 has learned the breach is bigger than we first thought.

CBS 2's Chris Tye reported Wednesday that five more people had their personal information released to a complete stranger.

CBS 2 learned of 11 on Tuesday and five more on Wednesday. The unlucky 16 whose names and Social Security numbers were spat out of a state computer last Monday, then printed and mailed to strangers who had no business having their private data, which could be terribly damaging in the wrong hands.

CBS 2 heard from two of the 16 victims, both retirees. Both said the breach rattled them. One of them was a victim of scammers earlier this year.

"I was in disbelief," said one man named Joe.

Joe's list arrived in his Alsip mailbox on Friday.

Diane's stack arrived in Chicago a day later.

"I was like oh my God, they sent me five different Social Security and names of people that I don't know at all," she said.

CBS 2 knows of at least 16 people: There are two Roberts, a Marlene, and a Ruth among them. Their Social Security numbers were mailed to total strangers by the Illinois Department of Employment Security - in letters intended to help curb unemployment fraud.

Professor Bill Kresse teaches at Governors State University.

"My mouth was agape. To send multiple letters to the same address, an unverified address is just irresponsible," Kresse said. "I've had cases where they've taken mortgages and purchased homes with that information."

Both Joe and Diane alerted the state to the breach days ago. Both are still waiting for a callback.

"The top of the pyramid is Governor Pritzker. He's the only person in Illinois who can fix this problem. These agencies are under his control," said Illinois U.S. Congressman Rodney Davis (R-Champaign).

Scammers stole the identity of downstate Congressman Rodney Davis this year, using the state's unemployment system.  On Wednesday, he demanded a better answer as to how Illinois is using the millions sent from Washington to enhance the unemployment system.

"I voted to give the state of Illinois to set up a system that wasn't going to fail so badly. Where did that $42 million go?" asked Davis.

"A stop has been put to those right now as they're trying to manage the incoming fraud," Gov. JB Prizker said.

Constituents called for a stop to mail deliveries exposing them to deeper fraud.

"They've got to own it. There's a very serious systemic problem," Diane said.

"It gives the impression that they don't care," added Kresse.

CBS 2 notified the State of Illinois of the problem, and finally, IDES acknowledged the huge mistake – blaming scammers for posing as companies and trying defraud benefits before the Pandemic Unemployment Assistance expires this week.

Until now, the state sent names and full Social Security numbers to employers for verification.

"This is something they might have gotten away with in the 80s or 90s, but you can't do that anymore," Kresse said.

IDES sent a statement to CBS 2 saying there are nationwide "fraudsters" who are getting people's personal information, including Social Security numbers, and the "fraudsters" are sending them out to random people.

"Fraud notices from IDES, containing the PII, were then sent to the addresses fraudsters claimed were employers. This is now another aggressive maneuver used by bad actors looking to defraud and disrupt states' unemployment systems," said IDES in a statement.

Individuals who inadvertently receive such notices containing a stranger's personal information are asked to call IDES at (800) 814-0513. After selecting the correct language:

▪ Press 1 for "someone who is reporting identity theft"
▪ Press 5 for "ID theft"
▪ Input your information for a callback

[scribd id=489029965 key=key-K00TvvI4lpIZgPQmKhhN mode=scroll]

According to IDES "fraudsters take this information and submit claims using a fake employer address, which can coincide with a residential address, or with an employer that has no connection to the victim. IDES's anti-fraud systems are structured to detect, stop, and flag these claims as fraudulent. However, this process does generate an employer notice, informing the employer of the fraudulent claim(s) filed on an employee."

IDES added "as a longstanding practice, IDES notices to employers contain PII to assist the employer in identifying which of their employees has filed for unemployment insurance benefits or which of their employees has had their identity stolen and had a fraudulent unemployment insurance claim filed in their name. IDES uncovered that employer notices have been mailed to addresses used by fraudsters when filing claims, reaching unsuspecting businesses and households whose addresses were used by fraudsters."

In light of the letters showing up in random mailboxes, IDES said it will come up with a new way to identify claimants – and a full Social Security number is no longer an option.

"But the last four digits are all you need," Kresse said.

As CBS 2's Jermont Terry reported, Kresse was amazed that it took CBS 2 to get the state to know such personal information is just too sensitive to mail.

"hopefully this will be a lesson they'll take to heart, and it won't take a report from Channel 2 to straighten their practices," Kresse said.

Meanwhile, fraud experts recommend that everyone check their credit report to make sure their personal information is not compromised.

CBS 2's Chris Tye and Jermont Terry contributed to this report.

Also From CBS Chicago:

• Chicago Police Sergeant Relieved Of Powers After She Was Arrested On Charges Of Drunkenly Hitting Gaming Officer At Horseshoe Hammond Casino
• ONLY ON 2: Widow Speaks After Husband Gave Up Jeep Cherokee, Only To Be Shot Dead By Carjackers Anyway In Bridgeport
• Hershey's Demands Payment From Wauconda's Side Lot Brewing Over Beer Offerings With Milk Duds, Jolly Ranchers