HackingVulnerability ExploitSupply Chain (3P Vendor)Zero-DayIDENTITY_BASICHEALTH_BASICPHILowContained
INDEPENDENT LIVING SYSTEMS, LLC.
bd_fa7fed195d36b02c · schema v1 · pii pii-v1
Full breach record for INDEPENDENT LIVING SYSTEMS, LLC. →Independent Living Systems, LLC notified Vermont AG of a data breach involving Progress Software's MOVEit Transfer tool. The incident, stemming from a zero-day vulnerability disclosed on May 31, 2023, potentially exposed PHI and personal information (names, DOB, policy numbers). ILS engaged forensic experts and law enforcement, ceased using the tool, and offered two years of credit monitoring.
Vermont clock✗ VT AG >45 bday27 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_4457777d8bbc94feVermont State AGfiled 2023-12-08Candidate
- bd_6dfd5bc658e9797dMontana State AGfiled 2023-12-08Candidate
Source provenance
- Source URL
- https://ago.vermont.gov/document/2023-12-08-independent-living-systems-progress-software-moveit-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Dec 8, 2023
- Raw hash
- b4ad90642a10d8c08f3123d19739adaa1d296f6294a2d089c33b9ecc130a8dcb
Reporting entity
- Name
- INDEPENDENT LIVING SYSTEMS, LLC.norm: independent living
- Domain
- ilshealth.com
Victim entity
- Name
- INDEPENDENT LIVING SYSTEMS, LLC.norm: independent living
- Domain
- ilshealth.com
Incident
- Discovered
- May 31, 2023
- Materiality determined
- Dec 8, 2023
- Notification sent
- Dec 8, 2023
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICHEALTH_BASICPHI
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1190 Exploit Public-Facing Application
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified law enforcement
- Third party
- via Progress Software
- Initial access
- supply_chain
Compliance
- Time to disclose
- 27 weeks(191 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.