Short answer
RevSpring, a technology company that runs online bill-pay for healthcare providers, says it found on 17 August 2026 that an unauthorized person may have reached a support tool for its bill-pay platform. The person used it between 15 May and 1 June 2026 to obtain patient information. Notices began 4 November 2026.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | RevSpring, Inc. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Healthcare billing technology (patient payments) |
| Country | United States |
| Detected | 2026-08-17 |
| Disclosed | 2026-11-04 |
| People or records affected | Not stated by RevSpring; Vermont's listing records 569 Vermont residents |
What data was exposed
- Names, home addresses, email addresses and phone numbers
- Dates of birth and Social Security numbers
- Location of service (the healthcare provider's site)
- RevSpring says diagnosis and treatment details, debit or credit card numbers and bank account information were not involved
What happened
RevSpring is a technology services company. It provides the online bill-pay platform that some healthcare providers use to collect patient payments. In its notice filed with the California Attorney General, the company says it discovered on 17 August 2026 that an unauthorized person may have gained access to a support tool that could be used to obtain information about patients who used the platform.
RevSpring launched an investigation, engaged outside cybersecurity experts and notified law enforcement. The investigation determined that the unauthorized person successfully used the tool between 15 May and 1 June 2026 to obtain certain information about patients of the affected healthcare providers. The notice is a template, and each provider is told on its own date.
What data was involved
The letter says the information varies by person and may include name, home address, email address, phone number, date of birth, Social Security number and the location of service. RevSpring says the accessed information did not include details of medical care, such as diagnosis or treatment, and that no debit or credit card numbers or bank account information were involved. It also states that the incident did not involve the healthcare provider’s own environment or an electronic medical record.
The Vermont Attorney General’s listing records a RevSpring notice dated 4 November 2026 with 569 Vermont residents and Social Security numbers as the data type. Other states will have their own counts, and RevSpring has not published a combined figure in the sources we reviewed.
What RevSpring is offering
The company says it added technical safeguards and secured Kroll to provide identity monitoring at no cost, including credit monitoring, fraud consultation and identity theft restoration. The length of service and the activation deadline are printed in each letter. The help line is (844) 971-8621, Monday to Friday, 8 a.m. to 5:30 p.m. Central.
What is still unknown
- the total number of people affected across all providers;
- which healthcare providers’ patients were included;
- how the unauthorized person reached the support tool, which the notice does not describe;
- whether anyone has claimed the incident. We found no claim in the sources reviewed.
Staying safe
Billing is an easy theme for a scam message, and a stolen name, address and provider name make a fake payment request look real. Our guide to phishing messages shows how to check a sender, urgent payment scams covers pressure to pay now, and what to do after a data breach covers freezes and monitoring.
More recent incidents are on the breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Texts or emails posing as your hospital, clinic or 'RevSpring' with a link to pay a bill or 'verify' your account
- Callers who know your provider's name and your address and claim to be from billing or collections
- Fake credit-monitoring offers that mimic the Kroll enrollment in the real letter
- Identity-theft attempts using a Social Security number and date of birth
What to do if you are affected
- 01If you receive a RevSpring letter, enroll in the free Kroll identity monitoring using the code and Verification ID in the letter, before the deadline it states.
- 02Enroll only at Enroll.krollmonitoring.com/redeem as printed in your letter. Do not click payment or verification links in unexpected messages.
- 03Pay medical bills only through your provider's website or the phone number on a statement you already trust.
- 04Review statements from your providers and financial institutions and your credit reports, and report anything unfamiliar.
- 05Consider a free credit freeze with Equifax, Experian and TransUnion. RevSpring's help line for the incident is (844) 971-8621.
Frequently asked questions
Why did I get a letter from RevSpring?
RevSpring provides the online bill-pay platform used by some healthcare providers. If one of your providers uses it, your details may have passed through its systems even if you have never heard of RevSpring.
Was my medical record accessed?
RevSpring says the incident did not involve your provider's environment or access to your electronic medical record, and that the data did not include diagnosis or treatment details.
Were my card or bank details taken?
RevSpring's letter says no debit or credit card numbers or bank account information were involved.
How long was the tool accessed?
The letter says the unauthorized person successfully used the support tool between 15 May and 1 June 2026. RevSpring discovered the possible access on 17 August 2026.
How many people are affected?
RevSpring has not published a total in the sources we reviewed. The Vermont Attorney General's listing records 569 Vermont residents, which is one state's count.
Sources
- RevSpring notice of data breach (California notification), California Attorney General (organization notice), 2026-11-04
- Security breach notices, RevSpring, Inc. (11-4-2026), Vermont Attorney General, 2026-11-04
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.