Averhealth Holdings, a nationwide substance use disorder recovery and laboratory testing company, identified unusual activity in its Avertest Inc. email environment on January 20, 2026. This activity led to unauthorized access between December 19, 2025, and January 21, 2026. The company began notifying affected individuals on July 2, 2026, and notified the Vermont Attorney General on July 10, 2026.
The breach involved sensitive personal and clinical information. Data types exposed include name, clinical information, diagnosis, digital/electronic signature, date of birth, driver’s license number, health insurance policy number, medical cost, medical dates of service, medical history, provider name, medical record number, treatment/procedure information, mental/physical condition, minor status, patient account number, and Social Security numbers. The total number of affected individuals has not yet been publicly disclosed. Averhealth has stated that not all information was impacted for all individuals and is offering complimentary credit monitoring for those whose Social Security numbers were exposed.
A class action lawsuit investigation has been launched in response to the breach. While no evidence of identity theft or financial fraud has been found, the company engaged external cybersecurity professionals to investigate and contain the incident. Details regarding nationwide impact and specific affected counts await further disclosure.