RevSpring, Inc., a healthcare engagement and revenue-cycle technology provider, disclosed a data security incident to regulators in November 2026. According to regulatory filings and client notices, unauthorized access to a support tool occurred between mid-May and June 2026. RevSpring discovered the activity on August 17, 2026, and submitted breach reports to state regulators, including the California and Vermont Attorneys General, in early November 2026.
The compromised information varies by individual and includes Social Security numbers, names, addresses, email addresses, phone numbers, and dates of birth. Notices issued by downstream healthcare clients indicate that clinical treatment records, medical diagnoses, and financial account or payment card information were not compromised. While filings confirm at least 569 Vermont residents were impacted, the total nationwide number of individuals affected remains undisclosed.
RevSpring began sending written notifications directly to affected individuals on or around November 4, 2026. As forensic investigations continue and regulatory reviews proceed, additional details regarding the total scope of affected individuals across other states may be identified.