Endeavor Health Medical Group, Neurology Skokie Ambulatory Care Center data breach investigation

Investigation notes

Endeavor Health Medical Group, Neurology Skokie Ambulatory Care Center operates as a specialized neurological healthcare provider within the broader Illinois medical ecosystem, offering advanced diagnostic, consultative, and therapeutic services for complex neurological conditions such as epilepsy, stroke, multiple sclerosis, and neurodegenerative disorders. Because specialized neurological care requires comprehensive patient histories, ongoing diagnostic imaging, detailed neurophysiological testing, and intricate pharmaceutical management, the facility routinely gathers and maintains highly intimate personal and medical documentation. This expansive repository of sensitive health data is essential for ongoing patient treatment and medical administration, but it simultaneously transforms the center into a high-value target for malicious cyber actors seeking to exploit confidential information. In 2025, Endeavor Health Medical Group, Neurology Skokie Ambulatory Care Center reported a significant data security incident to the Office of the Illinois Attorney General. While the full mechanics of the intrusion continue to be evaluated, breaches affecting specialized outpatient medical clinics typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized entry into electronic health record (EHR) environments, or vulnerabilities within third-party administrative and billing vendors. In the healthcare sector, attackers frequently target legacy systems, misconfigured cloud databases, or unwary employees through targeted phishing campaigns to bypass perimeter defenses and exfiltrate vast quantities of proprietary patient files. The exposure resulting from this security failure encompasses a dangerous spectrum of personal identifying information (PII) and protected health information (PHI), including full names, dates of birth, Social Security numbers, medical record numbers, health insurance policy details, and granular clinical data relating to diagnoses, treatments, and prescriptions. The compromise of clinical and diagnostic data is particularly severe because it cannot be easily changed like a password or credit card number. When combined with Social Security numbers and financial data, exposed healthcare records expose victims to enduring risks of medical identity theft—where fraudsters obtain unauthorized care using a victim's insurance—as well as targeted financial fraud, tax refund scams, and intrusive phishing schemes that exploit a patient's specific medical conditions. As a covered entity handling protected health information, Endeavor Health Medical Group, Neurology Skokie Ambulatory Care Center was bound by strict regulatory mandates under the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable Illinois consumer protection statutes. These legal frameworks require healthcare providers to implement robust administrative, physical, and technical safeguards, including comprehensive data encryption, multi-factor authentication, regular vulnerability assessments, and stringent vendor oversight. The occurrence of a data breach of this magnitude strongly suggests potential systemic failures in maintaining these mandatory security controls, raising serious questions about whether the facility met its legal duty of care to safeguard patient data. Receiving a formal data breach notification letter from Endeavor Health Medical Group, Neurology Skokie Ambulatory Care Center serves as legal confirmation that your confidential records were compromised as a direct result of the organization's inadequate security measures. Under Illinois law, the receipt of this notice establishes the legal standing necessary to participate in a class action lawsuit seeking accountability, institutional security reforms, and financial compensation for the stress and risks inflicted. Importantly, affected individuals do not need to prove that they have already suffered direct financial loss to seek legal recourse; the mere exposure of your sensitive medical and personal data is sufficient to take action. Our firm evaluates and litigates these cases on a strict contingency fee basis, meaning you pay nothing out of pocket and owe no legal fees unless we successfully recover compensation on your behalf.