RevSpring says an intruder used its bill pay support tool to pull patient Social Security numbers

What happened in the RevSpring data breach?

RevSpring describes itself in the letter as the provider of the online bill pay platform used by one of the recipient's healthcare providers. The information came from the back-end bill pay services, not from the provider's own systems.

On August 17, 2026, RevSpring discovered that an unauthorized person may have gained access to a support tool that could be used to look up information about patients who used the bill pay platform. The company says it opened an investigation, brought in outside cybersecurity experts and notified law enforcement. The investigation found that the tool was used successfully over about two and a half weeks, from May 15 to June 1, 2026.

That puts 77 days between the last day of access (June 1) and the day RevSpring found it (August 17), and 79 more days before the letter reached California's attorney general on November 4. California's record gives the same breach dates, May 15 and June 1, 2026.

The letter says the incident did not involve the healthcare provider's own environment or access to the patient's electronic medical record.

What information was exposed?

What was taken varies from person to person. The letter lists name, home address, email address, phone number, date of birth, Social Security number and location of service.

It also says what was not involved: no details of medical care such as diagnosis or treatment, and no debit card, credit card or bank account numbers.

In the letter	Status
Name, home address, email, phone	May be involved
Date of birth	May be involved
Social Security number	May be involved
Location of service	May be involved
Diagnosis or treatment details	Not involved
Card or bank account numbers	Not involved

What is RevSpring offering people who got a letter?

RevSpring has arranged identity monitoring from Kroll at no cost, covering credit monitoring, fraud consultation and identity theft restoration. The credit monitoring is single-bureau: alerts come when a credit file changes, for example when someone applies for new credit in the recipient's name. To get credit services a person must be over 18, have established credit in the U.S., have a Social Security number in their name and have a U.S. home address tied to their credit file.

Enrollment is at Enroll.krollmonitoring.com/redeem with the activation code and verification ID printed in each letter. The filed copy is the blank template, so the length of the monitoring and the enrollment deadline appear only in the letters people received.

The company says it has added new technical safeguards and other measures. Questions go to a toll-free line, (844) 971-8621, Monday to Friday from 8:00 a.m. to 5:30 p.m. Central Time.

How many people were affected?

The letter gives one count, for a single state: 216 people in Rhode Island. Two state lists have since added RevSpring. Massachusetts' consumer affairs office lists a report from RevSpring, Inc. dated November 4, 2026, the same day the letter reached California (breach 2026-1933): 1,591 Massachusetts residents affected. The only category it marks as breached is Social Security numbers. Texas's attorney general published a report from RevSpring, Inc. on November 6, 2026, with 6,252 Texans affected. Both counts cover one state's residents only. Washington's list did not include RevSpring when this site read it on November 6, 2026, and the national total is still unknown.

What the notice leaves open

The letter does not say how the unauthorized person got into the support tool, or which healthcare providers' patients are involved. It does not say whether the information has been misused. Each patient's own letter gives the date their provider was told.