{
  "id": "revspring-bill-pay-data",
  "url": "https://ohshit.app/incidents/revspring-bill-pay-data/",
  "title": "RevSpring confirms healthcare bill-pay data theft affecting 1,974,069 people",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-04",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "RevSpring",
    "data breach",
    "healthcare"
  ],
  "ecosystems": [],
  "summary": "RevSpring says an unauthorized person used a support tool to obtain patient information from its bill-pay platform. Its Texas filing reports 1,974,069 affected people. Some records included Social Security numbers. The company excludes diagnosis, treatment, payment-card and bank account data.",
  "splash": "Patients whose healthcare provider used RevSpring's bill-pay platform and whose records were reachable through the affected tool.",
  "wipe": "Verify your notice with the provider, enroll in the offered monitoring if eligible, and watch for identity misuse.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify which patient and billing details were involved",
      "hint": "Contact your healthcare provider through its usual billing or privacy office and keep the letter. Check the data fields, monitoring duration and deadline in your own notice. The California sample has placeholders for duration and deadline."
    },
    {
      "title": "Activate the offered monitoring through Kroll",
      "hint": "Use enroll.krollmonitoring.com/redeem with the activation code and verification ID in your verified letter. For assistance call 844-971-8621 on weekdays from 08:00 to 17:30 Central time, excluding major U.S. holidays."
    },
    {
      "title": "Look for identity misuse and unfamiliar bills",
      "hint": "Check provider and financial statements and request free credit reports at AnnualCreditReport.com. If your Social Security number was involved, consider a credit freeze with Equifax, Experian and TransUnion. Report suspicious activity to the affected organization and use IdentityTheft.gov if you discover identity theft."
    }
  ],
  "sources": [
    {
      "name": "RevSpring sample notice filed with the California Attorney General",
      "url": "https://oag.ca.gov/system/files/RevSpring_California%20Notification.pdf",
      "says": "Describes the support tool, dates, data scope and exclusions, investigation, safeguards and Kroll enrollment.",
      "primary": true
    },
    {
      "name": "Vermont Attorney General security breach register",
      "url": "https://ago.vermont.gov/categories/security-breach-notices?page=1",
      "says": "Lists the November 4 report, 569 Vermont residents and Social Security numbers.",
      "primary": true
    },
    {
      "name": "Texas Attorney General public breach register",
      "url": "https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage",
      "says": "Public record BR-0005491 lists the overall and Texas totals, mailed notice, four data categories and a September 9 discovery date.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "RevSpring confirms an unauthorized person obtained data through its support tool.",
  "mitigation": null,
  "timeline": [
    {
      "date": "May 15–Jun 1, 2026",
      "title": "Unauthorized person obtains patient information",
      "body": "The company dates the support-tool activity to this period."
    },
    {
      "date": "Aug 17, 2026",
      "title": "RevSpring says it discovered possible unauthorized access",
      "body": "It engaged external cybersecurity experts and notified law enforcement."
    },
    {
      "date": "Nov 4, 2026",
      "title": "State regulators publish breach notices",
      "body": "California publishes a sample letter, and Vermont lists 569 affected residents."
    },
    {
      "date": "Nov 6, 2026",
      "title": "Texas publishes the overall count reported by RevSpring",
      "body": "Report BR-0005491 lists 1,974,069 people overall, including 6,252 Texans."
    }
  ],
  "body_markdown": "RevSpring provides back-end bill-payment services for healthcare providers. Its investigation found that an unauthorized person obtained patient data through its support tool between May 15 and June 1. Possible fields include names, addresses, email addresses, phone numbers, dates of birth, Social Security numbers and service locations. RevSpring says healthcare providers' systems and electronic medical records were outside the incident. The notice also excludes diagnosis and treatment details, card numbers and bank account information.\n\nThe California letter dates discovery of possible unauthorized access to August 17. The Texas register lists September 9 in its discovery field and gives no explanation for the difference. Texas reports **1,974,069 affected people**, including **6,252 Texans**. Vermont’s **569** is a state count. The sample letter says RevSpring added safeguards. It leaves the initial access method and specific technical changes undisclosed."
}