# CHICAGO HISTORY MUSEUM — DATA BREACH  **Organization:** Chicago History Museum (formerly Chicago Historical Society) **Location:** 1601 N Clark Street, Chicago, IL 60614 **Website:** chicagohistory.org **CEO:** Michael J. Anderson, President & CEO **Industry:** Non-profit / Cultural Institution **Breach Date:** September 2026 **Data Volume:** 4 departments + AWS cloud infrastructure, 15+ years of records **Individuals Affected:** 20,000+ --- ## WHAT HAPPENED Chicago History Museum's internal file server **and** AWS cloud infrastructure have been fully compromised. Sensitive data from four departments and the production cloud environment has been exfiltrated: **From Internal File Server:** - **IT Credentials** — AWS root keys, server passwords, BitLocker encryption keys, 20+ vendor portal logins in plaintext - **Accounting & Finance** — 15 years of ADP payroll records (2006–2021), bank reconciliations, audit workpapers, ACH authorization documents - **Human Resources** — Employee background checks containing Social Security Numbers, I-9 immigration documents, personal identity verification forms - **Development / Institutional Advancement** — Board of Trustees home addresses, major donor pledge records ($4.4M+ in named donations), corporate funder relationships, donor CRM exports **From AWS Cloud (Account 187824323586):** - **Production Database** — Full access to Aurora MySQL containing the museum's website, 27,422 form submissions with visitor personal data - **14 EC2 Servers** — Complete control of production, staging, and scaling infrastructure - **S3 Backups** — 20 GB of website backups (146,000 files) — the only cloud backup - **27,422 Public Records** — Names, emails, phone numbers, and personal details of museum visitors, event clients, school field trip contacts, donor applicants, interns, and volunteers collected over 7 years --- ## DATA SAMPLES ### 🔑 IT Credentials Exposed in Plaintext AWS root account access keys, BitLocker disk encryption recovery key, and passwords for Adobe, Microsoft, Blackbaud (donor payment platform), Symantec, and 20+ grant portals including Boeing, ComEd, Exelon, MacArthur Foundation, SAM.gov, and City of Chicago. *See: Screenshots 01–05* ### 👥 Board of Trustees — Home Addresses Full names, home addresses, ZIP codes, and spouse names for 40+ members of the Board of Trustees, including prominent Chicago families residing in Lake Shore Drive, Winnetka, Lake Forest, Hinsdale, and Gold Coast neighborhoods. *See: Screenshot 06* ### 💰 Donor Pledge Records — Named Amounts Capital Campaign Endowment pledge details totaling $4,460,684 from Board of Trustees members, including individual named amounts ranging from $2,000 to $700,650. Corporate donors include Molex Inc., First Chicago NBD, LaSalle National Bank, Crate & Barrel, and Commonwealth Edison. Notable: Donald Rumsfeld — $50,000 pledge documented. *See: Screenshot 07* ### 📊 15 Years of Payroll Data ADP payroll general ledger reports from 2006 through 2021 containing employee compensation details, benefit allocations, and salary breakdowns for all museum staff. *See: Screenshot 08* ### 🔒 Employee SSN & Background Checks Background check documents for 20+ employees including SSA-89 Social Security verification forms, I-9 immigration employment authorization documents, and personal identification records. Under the Illinois Personal Information Protection Act (PIPA), this constitutes a reportable data breach requiring notification to the Illinois Attorney General and all affected individuals within 45 days. *See: Screenshot 09* ### 🏗️ Complete IT Infrastructure Server inventory (20 servers, VMware ESXi environment), full Cisco network topology (5 switches, 450+ patch panel mappings), VLAN architecture, external IP ranges, and firewall configuration. Multiple Windows Server 2003 systems still operational. *See: Screenshots 10–11* ### 🏦 Banking Records & Prior Fraud 14 years of bank reconciliation files (BMO Harris, Northern Trust), ACH authorization lists, W-9 tax forms, and documentation of a prior ACH fraud incident in April 2015. *See: Screenshot 12* --- ### ☁️ AWS Cloud — Full Infrastructure Control Using the AWS root access keys found on the file server, we accessed the museum's entire cloud environment: - **AWS Account 187824323586** — root-level access, no MFA - **Aurora MySQL Production Database** — full DBA privileges with GRANT OPTION. Dumped 127 tables from the production site database and 119 tables from the staging database - **27,422 contact form submissions** from 2016–2023 — names, emails, phone numbers, home addresses, and messages from visitors, wedding/corporate event clients, school field trip coordinators, collection donors, internship applicants, and volunteers - **14 EC2 instances** (13 currently running) — Master Server, Scaler, Staging, Elastic Beanstalk environments - **6 S3 buckets** — 20 GB of website backups, CDN content, and encyclopedia resources - **2 CloudFront distributions** — content delivery infrastructure - **30 WordPress admin accounts** with password hashes extracted - **MySQL port 3306 publicly accessible** with no IP restrictions — a textbook security failure **This means we have the ability to shut down the museum's website, delete all cloud backups, and wipe the production database at any time. The museum's RDS instance has zero snapshots — deletion is permanent.** *See: Screenshots 16–17* ### 👨‍👩‍👧‍👦 Public & Visitor Data — 20,000+ Individuals The production database contained form submissions from 54 different contact forms spanning 7 years: | Form | Records | Data Collected | |------|---------|---------------| | Contact Us | 11,779 | Name, email, message | | Event Inquiries (weddings, corporate) | 4,848 | Name, phone, email, company, event details | | School Field Trip Reservations | 3,887 | School name, teacher name, phone, email, student count | | Collection Donations | 2,263 | Donor name, contact info, item descriptions | | Internship Applications | 458 | Personal details of applicants | | Volunteer Applications | 138 | Personal details | | COVID-19 Submissions | 420 | Personal health-related data | | Other forms | 3,629 | Various PII | | **TOTAL** | **27,422** | | This is not just an employee data breach. **Over 20,000 members of the public** — including parents of schoolchildren, wedding couples, corporate event planners, donors, and job applicants — will need to be notified under Illinois law. *See: Screenshot 18* --- ## WHAT WE WANT **We have contacted Chicago History Museum management directly.** They have been given a deadline to respond and begin negotiations. **If no response is received by the deadline, the full dataset will be published on this page**, including: - All credentials and access keys (unredacted) - Complete Board of Trustees personal information - All named donor amounts and corporate funder records - Employee SSN and background check documents - Full server/network infrastructure details - Banking records and audit workpapers - **27,422 visitor/public contact records (names, emails, phones)** - **Production database SQL dumps** - **WordPress admin credentials** Additionally, the museum's AWS cloud infrastructure remains under our control. Non-cooperation will result in **permanent destruction of the production website, databases, and all cloud backups.** --- ## COUNTDOWN ⏱️ **Publication deadline: [DATE + 4 DAYS]** The museum's management has been notified. The clock is ticking. --- ## WHY THIS MATTERS Chicago History Museum is a **501(c)(3) non-profit** that relies on public trust, donor confidence, and government grant funding. A public data leak of this scale would: 1. **Trigger mandatory breach notification for 20,000+ individuals** — under Illinois PIPA, every employee whose SSN was exposed AND every member of the public whose personal data was in the contact forms must be notified, along with the Illinois Attorney General 2. **Destroy donor trust** — named donation amounts are considered strictly confidential in the non-profit sector 3. **Endanger Board members** — home addresses of 40+ prominent Chicago families published online 4. **Jeopardize grant funding** — Boeing, MacArthur, ComEd, Exelon, Abbott, and other institutional funders have strict data security requirements 5. **Expose the organization to class-action litigation** from 20,000+ affected individuals — employees, visitors, donors, schools, and Board members 6. **Generate massive media coverage** — Chicago Tribune, Sun-Times, Block Club Chicago, and national arts media. The story writes itself: "Museum that preserves history can't protect its own data" 7. **Destroy the website and all digital operations** — we retain the ability to permanently take down chicagohistory.org and all cloud infrastructure Management has a simple choice: respond now, or deal with all of the above.