Frequently asked questions: FEI data breach - January 2026

States hire vendors for this work because vendors have systems that are already in compliance with complex federal laws.

The individual who accessed the date was affiliated with a health care provider. They had legitimate reason to access limited information in MnCHOICES. DHS cannot disclose the name of the health care provider or the individual’s name due to data privacy laws.

The timeline reflects: FEI’s initial detection, DHS’s notification, a full forensic investigation, verification of which individuals were affected, the preparation of required notices under 45 C.F.R. section 164.404 (HIPAA) and Minnesota Statutes, section 13.055. Notifications cannot be sent until the investigation is complete.

DHS and its vendor, FEI Systems, confirmed that the unauthorized access stopped on September 21, 2025. The user’s access to MnCHOICES was fully removed on October 30, 2025. A cybersecurity firm conducted a forensic investigation and found no evidence that your information has been misused. DHS and FEI have since implemented additional technical safeguards to prevent similar incidents.

Yes. The system remains fully operational and continues to be used statewide. The incident involved a single user accessing more information than necessary—there is no evidence of a system breach or external hack. DHS and FEI have strengthened monitoring and access controls to ensure the system remains secure.

While DHS cannot publicly disclose detailed security configurations, the measures include monitoring, access controls, and security safeguards. These steps are designed to prevent unauthorized access and detect issues more quickly.

No. MnCHOICES is a state required assessment system used to determine eligibility for longterm services and supports. State and federal laws require DHS to maintain assessment records and related data. Individuals cannot opt out of having their information included in MnCHOICES.

No. Only the last four digits were accessed.

TO COME

A credit freeze is optional. DHS recommends reviewing your credit reports and monitoring for unfamiliar activity. Review the information in the ‘What should you do?’ section of the letter you received.

• You get a bill from your doctor or an Explanation of Benefits statement for services you didn't get or prescription medications you don't take.
• You're contacted by a debt collector about a medical debt you don't owe.
• You review your credit report and see medical debt collection notices that you don't recognize.
• You get a notice from your health insurance company saying you reached your benefit limit.

• What to know about medical identify theft 
• Report errors. Report any medical billing errors to all three credit bureaus by following the “What To Do Next” steps on IdentityTheft.gov.

No, but you can request a free credit report at www.annualcreditreport.com or over the telephone at 1-877-322-8228.

No. Your services, eligibility, and assessments are not impacted.

303,965 individuals.

No. The forensic investigation identifies categories of data accessed, not individual record‑by‑record viewing.

No. Your services, eligibility, and assessments are not impacted.

You can request your information through a Data Request.

Learn more about What to Do After a Data Breach. You have a right to receive, at your request, a free copy of your credit report.