Independent Living Systems hacked and then sued five times, notifies 4.2 million affected patients/consumers 8 months after

(Image source: ILS, n.d.)

Update 4/16/2023: Included FBI’s involvement per Iowa HHS

One-sentence summary:

Miami-based Independent Living Systems was hacked in mid-2022 during a breach that affected 4.2 million patients/consumers and notifies patients/consumers 8 months after its breach, resulting in five class-action lawsuits.

Who was involved?

Independent Living Systems, LLC, “which is a business associate to its covered entity subsidiaries Florida Community Care LLC and HPMP of Florida Inc. d/b/a Florida Complete Care,” an adversary, FBI, and over 4,226,508 consumers/patients (Independent Living Systems, LLC, 2023; Williams, 2023).

What was the timeline?

June 30, 2022: Adversary breaches ILS’s information systems

July 5, 2022: ILS detects the breach and begins incident response efforts

January 17, 2023: Incident review milestone for ILS

March 14, 2023: ILS begins patient and consumer breach notification (Williams, 2023)

March 17, 2023: Riggins v. Independent Living Systems, LLC is filed in the Southern District of Florida (Justia, 2023)

March 21, 2023: HIPAA Journal reports at least five separate class action lawsuits filed against Independent Living Systems (Emerson Firm, 2023)

What occurred?

ILS was hacked through an undisclosed method in mid-2022, which resulted in the breach of the PII or PHI of over 4.2 million consumers and patients. Extensive investigation took place and involved the FBI (Iowa HHS, 2023). The information disclosed included: “name, address, date of birth, driver’s license, state identification, Social Security number, financial account information, medical record number, Medicare or Medicaid identification, CIN#, mental or physical treatment/condition information, food delivery information, diagnosis code or diagnosis information, admission/discharge date, prescription information, billing/claims information, patient name, and health insurance information” (Independent Living Systems, LLC, 2023, para. 4). Independent Living Systems is facing at least five separate class action lawsuits (HIPAA Journal, 2023). Additional information has transpired indicating Iowa Medicaid has been breached as a fourth party, connecting this breach to other breaches.

Estimated costs:

Associated incident response costs, 12 months of Experian credit services, “outside cybersecurity specialists,” potential breach notification costs, 7-day-a-week call center, litigation defense costs

Involved laws:

Federal: HIPAA and HITECH.

State laws: Maine: 10 M.R.S.A. § 1346

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

Despite not disclosing a root cause or the nature of the attack, per ILS: “(1) fortifying the security of our firewall; (2) utilizing the forensic specialists engaged to monitor our network and remediate any suspicious activity identified; (3) rotating and increasing the complexity of all users’ credentials, and (4) providing notification to potentially affected individuals as quickly as possible” (Independent Living Systems, LLC, 2023, para. 4).

Sources:

HIPAA Journal. (2023, March 27). Independent Living Systems Sued Over 4 Million-Record Data Breach. Retrieved April 4, 2023, from https://www.hipaajournal.com/independent-living-systems-sued-over-4-million-record-data-breach/

ILS. (n.d.). untitled. GlobeNewswire. https://ml.globenewswire.com/Resource/Download/7db3d4dc-e6c6-4e27-b1e5-a17eff82431b

ILS. (2023). ILS – Notice of Data Event – ME.pdf. In Office of the Maine Attorney General: Data Breach Notifications. Office of the Maine Attorney General. Retrieved March 17, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/aacdb720-e082-4ef6-b7e6-f03280b2c4ec/068bb4a0-32fa-48f7-822f-fa1083ae1a75/document.html

Independent Living Systems, LLC. (2023, March 15). Supplemental Notice of Data Event – ILS. ILS. Retrieved March 17, 2023, from https://ilshealth.com/supplemental-data-notice/

Iowa HHS. (2023). April 23 Medicaid Breach FAQ. In Iowa HHS. Iowa Department of Health and Human Services. Retrieved April 16, 2023, from https://hhs.iowa.gov/sites/default/files/April_23_Medicaid_Breach_FAQ.pdf

Justia. (2023, March 17). Riggins v. Independent Living Systems, LLC. Justia Dockets & Filings. Retrieved April 4, 2023, from https://dockets.justia.com/docket/florida/flsdce/1:2023cv21046/639328

Williams, S. (2023, March 14). Office of the Maine AG: Consumer Protection: Privacy, Identity Theft and Data Security Breaches. Office of the Maine Attorney General. Retrieved March 17, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/aacdb720-e082-4ef6-b7e6-f03280b2c4ec.shtml

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com