RevSpring confirms healthcare bill-pay data theft affecting 1,974,069 people
RevSpring says an unauthorized person used a support tool to obtain patient information from its bill-pay platform. Its Texas filing reports 1,974,069 affected people. Some records included Social Security numbers. The company excludes diagnosis, treatment, payment-card and bank account data.
- Disclosed
- Nov 4, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Patients whose healthcare provider used RevSpring's bill-pay platform and whose records were reachable through the affected tool.
- RevSpring · data breach · healthcare
- In the wild
- Yes
- RevSpring confirms an unauthorized person obtained data through its support tool.
What happened
RevSpring provides back-end bill-payment services for healthcare providers. Its investigation found that an unauthorized person obtained patient data through its support tool between May 15 and June 1. Possible fields include names, addresses, email addresses, phone numbers, dates of birth, Social Security numbers and service locations. RevSpring says healthcare providers’ systems and electronic medical records were outside the incident. The notice also excludes diagnosis and treatment details, card numbers and bank account information.
The California letter dates discovery of possible unauthorized access to August 17. The Texas register lists September 9 in its discovery field and gives no explanation for the difference. Texas reports 1,974,069 affected people, including 6,252 Texans. Vermont’s 569 is a state count. The sample letter says RevSpring added safeguards. It leaves the initial access method and specific technical changes undisclosed.
Crime-scene timeline
May 15–Jun 1, 2026
Unauthorized person obtains patient information
The company dates the support-tool activity to this period.
Aug 17, 2026
RevSpring says it discovered possible unauthorized access
It engaged external cybersecurity experts and notified law enforcement.
Nov 4, 2026
State regulators publish breach notices
California publishes a sample letter, and Vermont lists 569 affected residents.
Nov 6, 2026
Texas publishes the overall count reported by RevSpring
Report BR-0005491 lists 1,974,069 people overall, including 6,252 Texans.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- RevSpring sample notice filed with the California Attorney GeneralPrimaryDescribes the support tool, dates, data scope and exclusions, investigation, safeguards and Kroll enrollment.
- Vermont Attorney General security breach registerPrimaryLists the November 4 report, 569 Vermont residents and Social Security numbers.
- Texas Attorney General public breach registerPrimaryPublic record BR-0005491 lists the overall and Texas totals, mailed notice, four data categories and a September 9 discovery date.