How long does a company have to notify me of a data breach in Illinois?

Under Illinois law, companies must notify affected residents within Most expedient time (PIPA); no delay permitted (BIPA) of discovering a breach. Failure to notify within this window is itself a violation of state law.

Illinois Attorney General Database

Illinois Data Breach Notification Letters

Q: What is the Illinois data breach notification law?

Illinois data breaches are governed by the Illinois Personal Information Protection Act (PIPA) & Biometric Information Privacy Act (BIPA). Illinois has two powerful data protection laws. PIPA governs traditional data breaches. BIPA — unique in the country — specifically protects biometric data (fingerprints, facial recognition, retinal scans) and provides $1,000 to $5,000 in statutory damages per violation, per person. Illinois courts have issued some of the largest privacy settlements in U.S. history under BIPA.

We are tracking 50+ companies that sent data breach notification letters to Illinois residents and reported to the Illinois Attorney General. If you received a notice, you may qualify for compensation — at no cost to you.

50+

Active Cases

Most expedient time (PIPA); no delay permitted (BIPA)

Notification Deadline

Upfront Cost to You

Illinois Data Breach Law

Illinois Personal Information Protection Act (PIPA) & Biometric Information Privacy Act (BIPA)

Illinois has two powerful data protection laws. PIPA governs traditional data breaches. BIPA — unique in the country — specifically protects biometric data (fingerprints, facial recognition, retinal scans) and provides $1,000 to $5,000 in statutory damages per violation, per person. Illinois courts have issued some of the largest privacy settlements in U.S. history under BIPA.

Notification Window

Most expedient time (PIPA); no delay permitted (BIPA)

Available Damages

$1,000–$5,000 per BIPA violation (statutory); substantial actual damages under PIPA

Are You Eligible to File a Claim?

Illinois residents have some of the strongest data breach protections in the nation. BIPA claims alone have resulted in class action settlements exceeding $100 million. If your biometric data was collected or exposed without consent, you have a strong claim.

You received a data breach notification letter

Your personal information was exposed without your consent

You are a Illinois resident or your data was held by a Illinois company

You do not need to prove financial loss to qualify

Companies That Sent Notification Letters in Illinois

Each company below is an active case in our tracker. Click any company row to open its full case page — what information was exposed, the AG filing date, and how to start a free claim review.

NORTHWESTERN MEMORIAL HEALTHCARE

Reported Dec 2025Full Name, Date of Birth +6 more

UW HEALTH - NORTHERN ILLINOIS

Reported Dec 2025Full Name, Date of Birth +6 more

CARLE FOUNDATION

Reported Dec 2025Full Name, Date of Birth +6 more

WASHINGTON UNIVERSITY SCHOOL OF MEDICINE

Reported Dec 2025Full Name, Date of Birth +6 more

ENDEAVOR HEALTH

Reported Dec 2025Full Name, Date of Birth +6 more

ROSECRANCE, INC.

Reported Dec 2025Full Name, Date of Birth +6 more