Independent Living Systems Data Breach Sparks Class Action

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit alleges Independent Living Systems recklessly and/or negligently failed to protect itself from a data breach that compromised the personal information of over four million people.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 58-page lawsuit says that after the health-services company purportedly struggled to access certain computer systems on July 5, 2022, a subsequent investigation revealed that an unauthorized third party had hacked into its network between June 30 and July 5.

The suit relays that the private information of roughly 4.2 million current and former patients was compromised in the breach, including, but not limited to, names, dates of birth, Medicare and Medicaid identification details, food delivery information and other health insurance data.

According to the case, Independent Living Systems (ILS)—which partners with health insurance companies, hospitals and community organizations to provide a range of healthcare services for Florida’s aging population—failed to implement adequate cybersecurity policies to protect patients’ personal and medical information. The highly confidential data was allegedly stored unencrypted and unredacted in the defendant’s computer systems and left vulnerable to unauthorized disclosure, the complaint charges.

In addition, the filing takes issue with ILS’s alleged failure to promptly notify victims of the cyberattack. Although the company claims to have first detected unusual server activity in July 2022, notices were not sent out to impacted parties until March 2023, over eight months later, the lawsuit states.

The notices themselves offered scant details as to precisely when ILS discovered the data breach, how the cybercriminals gained access, why it took so long to contact victims and what steps are being taken to prevent future incidents, the suit shares.

As the case tells it, ILS should have been well aware of the threat of a cyberattack given the extremely valuable nature of the data stored in its systems and the prevalence of data breaches in the medical industry.

Indeed, current and former patients provided their sensitive data to ILS with the reasonable expectation that it would safeguard the information from unauthorized disclosure, the complaint adds.

As of the date the complaint was filed, ILS has offered victims two years of credit and identity monitoring services—a “wholly inadequate” gesture in the face of the lifelong risks impacted consumers may suffer, the suit contends.

The plaintiff, a Florida resident, received notice on March 14 of this year that her private information had been compromised in the ILS data breach, the case says. The woman, like other victims, now faces an ongoing risk of medical fraud, identity theft and other unwanted activity as a result of the company’s actions, the complaint charges.

The lawsuit looks to represent anyone in the United States whose personal information was compromised by an unauthorized party as a result of the data breach reported by Independent Living Systems in March 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.