Two Illinois laws shape what happens after data leaks: the Personal Information Protection Act and the Biometric Information Privacy Act. DarkThreat helps Chicago security teams watch the dark web for exposed staff and customer credentials, so they can start their assessment sooner.
The most common kinds of exposure tied to a company domain, and the ones most likely to raise questions under Illinois law.
Browser-saved logins, cookies and session tokens taken from infected staff or contractor devices and sold in bulk.
Email and password pairs from third-party breaches that may match logins your staff reuse at work.
Credentials for your customer-facing portals, which attackers test against your login pages.
Posts from initial access brokers advertising entry into corporate networks, VPNs or remote desktops.
Internal files, spreadsheets or database extracts posted to forums or leak sites.
Look-alike domains and fake profiles using your company name to target customers or staff.
Learn more about what infostealer logs contain and monitoring customer portal credentials.
Illinois' breach notification law is the Personal Information Protection Act (PIPA), 815 ILCS 530. The Illinois Attorney General says it applies to any entity that conducts business in Illinois and handles nonpublic personal information.
A dark web alert is not automatically a breach. It is a signal that your legal and incident response teams will want to assess. These are the questions PIPA asks.
Illinois PIPA covers a user name or email address combined with a password or security question and answer that would permit access to an online account. It also covers a name combined with data such as a Social Security number, driver’s licence number, financial account or card number, medical information, health insurance information or unique biometric data, when that data is not encrypted or redacted.
A data collector that owns or licenses the information notifies affected Illinois residents. A business that maintains or stores data it does not own must notify the owner or licensee immediately following discovery.
PIPA requires notice in the most expedient time possible and without unreasonable delay. It does not set a fixed number of days. If only online credentials are involved, the notice can direct residents to change their user name, password or security question.
A data collector that must notify more than 500 Illinois residents about a single breach must also notify the Illinois Attorney General, no later than it notifies consumers. The Attorney General may publish the name of the data collector, the types of information involved and the date range of the breach.
HIPAA covered entities and business associates that comply with HIPAA and HITECH are deemed to comply with PIPA. If they report a breach to the HHS Secretary, they must also notify the Illinois Attorney General within 5 business days.
A violation of PIPA is an unlawful practice under the Illinois Consumer Fraud and Deceptive Business Practices Act. Whether a specific exposure triggers notice is a question for your counsel.
If you find your own staff credentials in a leak, our guide to what to do if credentials are leaked on the dark web covers the first practical steps.
Section 45 requires a data collector that owns, licenses, maintains or stores records with Illinois residents' personal information to implement and maintain reasonable security measures.
It also reaches your contracts. When you disclose Illinois residents' personal information to another party, the contract must require that party to maintain reasonable security measures too.
The Act does not list specific controls or name dark web monitoring. Credential exposure alerts can help with the detection part of a reasonable program, and with checking whether vendors that hold your data have been exposed.
Many teams organize these controls with the NIST Cybersecurity Framework.
Employers that use fingerprint or face scans for timekeeping, building access or device login need to account for the Biometric Information Privacy Act (BIPA), 740 ILCS 14.
Unlike a password, a fingerprint cannot be reset after a leak. That is why the systems holding biometric data, and the staff accounts that can reach them, deserve close attention.
BIPA gives aggrieved people a private right of action. Liquidated damages are $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater.
A 2024 amendment, Public Act 103-0769, provides that repeated collection or disclosure of the same person's biometric data by the same method counts as a single violation. See detecting biometric data leaks for more.
Brokers, insurers and advisory firms hold account numbers and policy data that PIPA covers. Leaked advisor or agent logins can open the door to client records. See financial services, insurance and credential leak detection for insurance and financial advisors.
Plants and distribution operations can rely on shared accounts, remote access and biometric time clocks. Exposed remote access credentials give attackers a way in without any malware. See manufacturing.
Hospitals and clinics follow HIPAA and also owe the Illinois Attorney General notice within 5 business days of reporting a breach to HHS. See healthcare and HIPAA.
DarkThreat helps with the detection side of your program. It monitors for breached and leaked credentials tied to your domain and sends email notifications when something is found.
Those alerts support your incident response plan and your legal review under PIPA. They do not replace either, and no tool makes an organization compliant with Illinois law.
You can start with a 7-day free trial, and no credit card is required. Paid plans start from $288 per month. See pricing for plan details.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Tell us which domains, brands and vendors you need watched.
They can. PIPA covers a user name or email address combined with a password or security question and answer that would permit access to an online account. Whether a specific exposure requires notice depends on the facts, so involve your legal counsel early.
PIPA requires notice to affected residents in the most expedient time possible and without unreasonable delay. If more than 500 Illinois residents must be notified about a single breach, the Attorney General must be told no later than consumers are.
BIPA is mainly about how private entities collect, keep, disclose and destroy biometric identifiers. It also requires them to store, transmit and protect biometric data using the reasonable standard of care in their industry. Separately, PIPA lists unique biometric data as personal information for breach notice.
No tool can do that. DarkThreat supports the detection side of your security program by helping you find exposed credentials and leaked data. Notification decisions and legal compliance stay with your leadership and counsel.
DarkThreat offers a 7-day free trial with no credit card required. Paid plans start from $288 per month. See the pricing page for plan details.
This page summarizes public law and official regulator guidance for general information. It is not legal advice.
Explore DarkThreat coverage across additional US cities and states.
Join 500+ security teams monitoring 2M+ dark web sources daily. Schedule a demo to see the platform in action.
Setup in under 5 minutes · No agents or software required · Cancel anytime
