Cook County Health data breach: what happened and what to do

Cook County Health reported that drivers who weren't registered with its medical transportation partner got access to the health information of 898 health plan members, including names, phone numbers, home addresses and mobility status.

View all 13,177 breaches

Breach date: Jul 2021
Made public: 2 Jul 2021
Affected: 898
Data exposed: Names, Phone numbers, Physical addresses, Medical information
Last updated: 30 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Cook County Health reported a data incident to the U.S. Department of Health and Human Services (HHS) in mid-2021. It was not a hack. According to HHS's case description, a subcontractor of the organization's business associate (the company that arranged medical transportation) let drivers who were not registered with that business associate take trips for Cook County Health plan members.

What happened

Cook County Health determined that those unregistered drivers had access to the protected health information of 898 individuals. HHS lists the type of incident as unauthorized access or disclosure.

Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov

Last verified against the official page: 30 Oct 2026

How we research this Report an error

What was exposed

The information involved was names, phone numbers, home addresses and mobility status (for example, whether a member needs help getting in and out of a vehicle). There is no mention of Social Security numbers, financial details or medical records in the description.

What the organization did

Cook County Health notified HHS, the affected individuals and the media, and posted a substitute notice on its website.

What it means for you

The practical risk is smaller than in a ransomware case: the people who saw your details were drivers booked to take you somewhere. Still, a name, phone number and home address together are what scammers use to make a call or text sound legitimate, and a mobility status tells a caller something sensitive. Treat unexpected contact about rides, benefits or your health plan with suspicion, and confirm through the number on your member card.

What to do if you were in it

1

Verify unexpected contact

If someone calls or texts about a ride, your benefits or your health plan, hang up and call the number on your member card. The FTC's phishing guide: https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams
2

Watch your plan statements

Read your explanation of benefits for rides or services you didn't take, and report mismatches to your health plan.
3

Don't give out more information

Your health plan will not ask for your Social Security number or a payment by text. Hang up on callers who do.
4

Report misuse

If someone misuses your information, report it at https://www.identitytheft.gov.
5

Check whether your email or phone number shows up in this and other breaches

Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your data appears, so you know what to watch for.