Breach Report: Iowa Medicaid data breach affects 20,000+, linked to 4.2 million member breach, fourth-party risk underscored

(image source: Iowa Medicaid (Iowa Compass), 2022)

One-sentence summary:

Iowa Medicaid was breached with ILS in mid-2022, involving 20,000+ members and linked to ILS’s 4.2 million member breach, demonstrating fourth-party cyber risk.

Who was involved?

Iowa Department of Health and Human Services (HHS), Iowa Medicaid, 20,815 Iowa residents, Telligen, Independent Living systems, FBI, and a threat actor.

What was the timeline?

June 30, 2022-July 5, 2022: Independent Living Systems is breached, and 20,000+ Iowa Medicaid members are involved.

July 5, 2022: ILS detects the breach

February 14, 2023: ILS notifies Telligen of the breach

February 17, 2023: Telligen notifies Iowa HHS and Medicaid

April 11, 2023: Iowa HHS posts breach notice on their website

What occurred?

Over 20,000+ Iowa Medicaid members were involved in a major breach at Independently Living Systems (involving 4.2 million individuals), previously reported over a month ago (Iowa HHS 2023a; Iowa HHS 2023b). It was involved due to a fourth-party relationship. Iowa Medicaid originally contracted with Telligen, a healthcare consultancy. Telligen, a Medicaid contractor, was outsourcing a portion of their work to ILS, which was breached in the middle of last year. Due to this fourth-party relationship, data from Iowa Medicaid members was involved in the ILS breach. The specific data breached has not been disclosed at this time, and Iowa Medicaid is not currently listed on the Iowa OAG breach portal.

Estimated costs:

Breach notification costs, M-F call center

Involved laws:

Federal: HIPAA and HITECH

State: Iowa Code Chapter 715C

Root cause:

Iowa HHS/Medicaid: Fourth-party breach

ILS: TBA or N/A (see disclaimer)

Lessons learned:

Risk doesn’t stop at a third party. Fourth-party risk and beyond must be included in an organizational risk assessment, including the supply chain.

Sources:

Iowa HHS. (2023a). National Data Breach Impacts Some Iowa Medicaid Members. In Iowa HHS. Iowa Department of Health and Human Services. Retrieved April 16, 2023, from https://hhs.iowa.gov/national-data-breach-impacts-some-iowa-medicaid-members

Iowa HHS. (2023b). April 23 Medicaid Breach FAQ. In Iowa HHS. Iowa Department of Health and Human Services. Retrieved April 16, 2023, from https://hhs.iowa.gov/sites/default/files/April_23_Medicaid_Breach_FAQ.pdf

Iowa Medicaid (Iowa Compass). (2022, September 21). untitled. Facebook. https://www.facebook.com/compassiowa/photos/a.427466990622933/5408435359192713/?type=3

Iowa OAG. (2023). 2023 Security Breach Notification. In Attorney General Brenna Bird. Iowa Department of Justice. Retrieved April 16, 2023, from https://www.iowaattorneygeneral.gov/for-consumers/security-breach-notifications/2023-security-breach-notification

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com