HackingHealthcareTechnologyHealthcareVulnerability ExploitSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Health (basic)PHILowContained

INDEPENDENT LIVING SYSTEMS, LLC.

bd_4457777d8bbc94fe · schema v1 · pii pii-v1

Severity

Low

Discovered

May 31, 2023

Filed

Dec 8, 2023

To disclose

27 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

68%

Full breach record for INDEPENDENT LIVING SYSTEMS, LLC. →3 incidents on file

Independent Living Systems, LLC notified consumers of a data security incident involving the MOVEit Transfer tool by Progress Software. The incident, stemming from a vulnerability reported on May 31, 2023, potentially exposed personal health information (PHI) and personal data including names, addresses, dates of birth, and health insurance details. ILS engaged forensic experts and law enforcement, disabled the tool, and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday27 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 27 weeks / 191 days

May 31, 2023

Discovered

Dec 8, 2023

Filed

vs. sector median

+15 wks slower

This filing is one of 9 about the same incident.View merged incident

Part of Progress Software Corporation supply-chain incident (2023) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Montana State AGbd_6dfd5bc658e9797d2023-12-08Candidate
HHS OCRbd_aece37bd4f49f3c92023-12-08Verified by operator
Vermont State AGbd_fa7fed195d36b02c2023-12-08Verified by operator
Massachusetts State AGbd_6323db92803013782023-12-09 · +1dVerified

Show 4 more filings ↓up to 10d gap

New Hampshire State AGbd_20ccf505c4af4aa12023-12-14 · +6dVerified by operator
Maine State AGbd_ebbd786e3574a4702023-12-14 · +6dVerified by operator
New Hampshire State AGbd_4a2e35004801b2fa2023-12-15 · +7dVerified by operator
California State AGbd_93cc8702840423862023-12-18 · +10dVerified by operator

Name: INDEPENDENT LIVING SYSTEMS, LLC.
norm: independent living
Domain: ilshealth.com

Name: INDEPENDENT LIVING SYSTEMS, LLC.
norm: independent living
Domain: ilshealth.com
Industry: HealthcarellmTechnologyllm

Discovered: May 31, 2023
Materiality determined: —
Notification sent: Dec 8, 2023
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)PHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Third party: via Progress Software
Initial access: exploit_public_facing

During the incident: Launched an investigation with the assistance of cyber experts, law enforcement, and outside lawyers
Ceased using MOVEit Transfer
Disabled MOVEit Transfer in their system
Moved to other solutions for transfers
Providing access to credit monitoring and remediation services at no charge through Cyberscout’s Identity Force
Changes made: Moved to other solutions for transfers
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(191 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Montana State AGDec 8 · first

HHS OCRDec 8 · first

Vermont State AGDec 8 · first

Vermont State AGDec 8 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+6d

Maine State AG+6d

New Hampshire State AG+7d

California State AG+10d

Pattern: first filing Dec 8 (MT), last Dec 18 (CA) — a 10-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2023-12-08-upmc-health-plan-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 8, 2023
Raw hash: b05ebdc228dd850453cebfeaaf3c26eea66e55707f9b25fc40ce6dc0cbb638c6

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityINDEPENDENT LIVING SYSTEMS, LLC.

Victim entityINDEPENDENT LIVING SYSTEMS, LLC.

Incidentdiscovered May 31, 2023

Stated responseLaunched an investigation with the assistance of cyber experts, law enforcement, and outside lawyers

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov