The week in breach news Jan 28, 2026

The Illinois Department of Human Services (IDHS) confirmed a data breach that exposed sensitive records of roughly 700,000 individuals, marking one of the largest public-sector breaches in 2026.

According to the agency, the breach exposed two separate sets of records. The first involves personal and program-related data tied to more than 672,000 Medicaid and Medicare Savings Program recipients, including addresses, case numbers, demographic details and medical assistance plan names. A second set of records affected around 32,000 customers of the Division of Rehabilitation Services, exposing names, addresses, case details and referral information spanning multiple years.

IDHS said the investigation into the incident is ongoing, and officials are still working to determine how the intrusion occurred and whether additional data may have been accessed.

In an unusual cyber incident, a hacker repeatedly accessed the Supreme Court of the United States' electronic document filing system and posted personal data belonging to several victims on his Instagram account.

According to a filing in the U.S. District Court for the District of Columbia, the attacker unauthorizedly accessed the U.S. Supreme Court's restricted system multiple times using stolen credentials of an authorized user. Once logged in, the attacker accessed and stole personal information from victim accounts and publicly shared portions of that data on social media, highlighting how stolen credentials alone can be enough to compromise high-profile systems.

The Department of Education in Victoria, Australia, has confirmed a data breach that affected current students and inactive past student accounts across more than 1,700 government schools.

On January 14, the department said an unauthorized third party breached a school's network. A follow-up update on January 21 confirmed that the attacker accessed a Department of Education database containing student information. The exposed data includes student and school names, year levels and department-issued email addresses with encrypted passwords. The department stated that no other student data, such as dates of birth, home addresses, phone numbers or family details, was accessed.

At this stage, there is no evidence that the data has been publicly released or shared with third parties. The Office of the Victorian Information Commissioner (OVIC) has launched an investigation into the incident.

Spanish energy giant Endesa and its designated reference retailer Energía XXI have begun notifying customers after confirming a data breach that exposed customer information.

Endesa, Spain's largest electric utility serving more than 20 million customers across Spain and other European countries, said the incident involved unauthorized access to its commercial platform. The attackers accessed and likely exfiltrated customer identification data, including contact details, national ID numbers (DNI), contract information and payment details such as international banking account numbers (IBANs). The company stated the breach was quickly contained and confirmed that no passwords were compromised.

While Endesa says it has no evidence that the data has been misused, it has warned customers to stay alert for identity theft, phishing attempts and related fraud following the incident.