December 8th, 2023
About the Data Event
Independent Living Systems, LLC (“ILS”), which is a business associate to certain covered entities, including its own affiliates, is providing substitute notice of a recent data event that may impact certain individuals’ personal information or protected health information. We are providing information about the event and our response. We are unaware of any identity theft or fraud resulting from this event. We are providing this notice out of an abundance of caution.
Like many organizations, ILS used a tool from Progress Software called MOVEit Transfer to transfer files. As many of those organizations have discovered, MOVEit was subject to a previously unknown zero-day vulnerability that allowed unauthorized access to certain information. Immediately upon learning of this vulnerability, ILS ceased using MOVEit and launched an investigation to determine what information may have been accessed without authorization. On October 27, 2023, ILS determined that there is some evidence that files containing personal information or protected health information of its clients’ members were exposed as a result of the MOVEit vulnerability.
What Entities were Involved?
The affected covered entities include Aetna ACE, Agewell New York, LLC, Alliance for Aging, Inc., American Health Plan of Missouri, Inc., Kansas Superior Select, Inc., AmeriHealth Caritas Health Plan, Blue Cross Blue and Shield of Florida, Inc. d/b/a Florida Blue, Doctors HealthCare Plans, Inc., Florida Community Care, LLC, Highmark Wholecare f/k/a Gateway Health, Health Net Community Solutions, CalViva Health, Highmark, Inc., HPMP of Florida Inc. d/b/a Florida Complete Care, Jewish Community Services of South Florida, Inc., Molina Healthcare, Vivida Health, and UPMC Health Plan.
What Information was Affected?
The affected information included personal information or protected health information of ILS’ clients’ members, such as demographic information, social security numbers, and clinical and claims information.
What We Are Doing.
Information privacy and security are among our highest priorities, and we have security measures in place to protect the information entrusted to us. We responded immediately to this event by taking down the MOVEit system to prevent any further access and commence a comprehensive investigation. We are also reviewing and enhancing existing policies and procedures that relate to data privacy and security and have implemented additional safeguards to further secure the data present on our systems. Additionally, we promptly reported this event to both state and federal law enforcement and have continued to cooperate with the independent investigations of those authorities.
What You Can Do.
As a best practice, and although ILS is unaware of any such activities resulting from this event, individuals are encouraged to remain vigilant against unfamiliar activity that may appear on account statements or explanations of benefits. Any such activity should be reported to the appropriate insurance company, health care provider, or financial institution. Please also review the information contained in the attached “Steps You Can Take to Protect Personal Information.”
For more Information
If you have additional questions or concerns, please contact our dedicated DATA EVENT RESPONSE LINE at 1-833-960-4740.
STEPS YOU CAN TAKE TO PROTECT PERSONAL INFORMATION
Monitor Your Account
Under U.S. law, a consumer is entitled to one free credit report annually from each of the three major credit reporting bureaus, Equifax, Experian, and TransUnion. To order your free credit report, visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228. You may also directly contact the three major credit reporting bureaus listed below to request a free copy of your credit report.
Consumers have the right to place an initial or extended “fraud alert” on a credit file at no cost. An initial fraud alert is a one-year alert that is placed on a consumer’s credit file. Upon seeing a fraud alert display on a consumer’s credit file, a business is required to take steps to verify the consumer’s identity before extending new credit. If you are a victim of identity theft, you are entitled to an extended fraud alert, which is a fraud alert lasting seven years. Should you wish to place a fraud alert, please contact any one of the three major credit reporting bureaus listed below.
As an alternative to a fraud alert, consumers have the right to place a “credit freeze” on a credit report, which will prohibit a credit bureau from releasing information in the credit report without the consumer’s express authorization. The credit freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. However, you should be aware that using a credit freeze to take control over who gets access to the personal and financial information in your credit report may delay, interfere with, or prohibit the timely approval of any subsequent request or application you make regarding a new loan, credit, mortgage, or any other account involving the extension of credit. Pursuant to federal law, you cannot be charged to place or lift a credit freeze on your credit report. To request a security freeze, you will need to provide the following information:
Should you wish to place a credit freeze, please contact the three major credit reporting bureaus listed below:
You may further educate yourself regarding identity theft, fraud alerts, credit freezes, and the steps you can take to protect your personal information by contacting the consumer reporting bureaus, the Federal Trade Commission, or your state attorney general. The Federal Trade Commission may be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1- 877-438-4338); and TTY: 1-866-653-4261. The Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint with them. You can obtain further information on how to file such a complaint by way of the contact information listed above. You have the right to file a police report if you ever experience identity theft or fraud. To file a report with law enforcement for identity theft, you will likely need to provide some proof that you have been a victim. Instances of known or suspected identity theft should also be reported to law enforcement and your state attorney general. This notice has not been delayed by law enforcement.