Florida-based health services company Independent Living Systems (ILS) has started sending out notification letters to more than 4 million individuals to inform them of a data breach impacting their personal and medical information.
Founded in 2001, ILS has 10 offices across the US and provides managed care organizations and providers with clinical and third-party administrative services. The company serves over 4.2 million individuals.
The data breach, the company says, was discovered on July 5, 2022, when some of its systems became inaccessible. Its investigation into the incident revealed that an unauthorized party had access to certain systems for roughly a week, between June 30 and July 5.
“During that period, some information stored on the ILS network was acquired by the unauthorized actor, and other information was accessible and potentially viewed,” the company explains in a data breach notice.
On January 17, ILS learned that the personally identifiable information (PII) and protected health information (PHI) of its members was compromised during the attack.
The types of impacted information include names, addresses, birth dates, driver’s license details, IDs, Social Security numbers, financial account information, medical record numbers, diagnosis information, health insurance information, mental or physical treatment, and other health information.
The company has started sending notification letters to all impacted individuals and says that some of them were informed of the data breach in September 2022, via a preliminary notice posted on its website.
ILS informed the Maine Attorney General’s office that the data breach impacted more than 4.2 million individuals.
What the company has not said is what type of cyberattack it fell victim to. The fact that its systems became inaccessible suggests that file-encrypting ransomware was involved.
SecurityWeek has contacted ILS for additional clarifications on the incident and will update this article as soon as a reply arrives.
Related: 3.3 Million Impacted by Ransomware Attack at California Healthcare Provider
Related: Patient Information Compromised in Data Breach at San Diego Healthcare Provider
Related: Ransomware Hit 200 US Gov, Education and Healthcare Organizations in 2022
