Data leak
Minnesota DHS MnCHOICES Data Breach via FEI Systems - 304K Individuals
Primary Source βIncident Details
From August 28 to September 21, 2025, an individual affiliated with a licensed healthcare provider accessed the Minnesota Department of Human Services’ MnCHOICES disability services system without authorization. The unauthorized access was reported to Minnesota DHS by FEI Systems, the third-party vendor managing MnCHOICES, in November 2025. The user’s access was fully removed on October 30, 2025. Notification letters were issued on January 16, 2026, approximately 140 days after the breach began. Approximately 304,000 individuals were affected. For the majority, only demographic information was accessed; for 1,206 individuals, additional medical information and/or the last four digits of their Social Security numbers were also accessed. No data misuse had been identified at time of notification. Minnesota DHS declined to offer free credit monitoring due to the limited nature of the data accessed. The delayed disclosure triggered class action investigations by Lynch Carpenter and Srourian Law Firm. The breach also prompted Minnesota to delay rollout of a new disability waiver program.
Technical Details
- Initial Attack Vector
- A user affiliated with a licensed healthcare provider accessed the MnCHOICES disability services system without authorization; unauthorized access occurred through a third-party vendor (FEI Systems) managing the platform
- Vendor / Product
- FEI Systems MnCHOICES (disability waiver case management)
Timeline
- 2025-08-28 Breach occurred
- 2026-01-16 Publicly disclosed
- 2026-01-16 Customers notified