November 4, 2026: RevSpring, Inc., which prints and sends patient billing statements and processes payments for healthcare providers, filed a security breach notice with the Vermont Attorney General. The filing lists Social Security numbers as the data involved and 569 Vermont residents affected. RevSpring has not published a statement, a cause or a national total. The catalog entry records the filing.
Who RevSpring is
RevSpring has operated since 1981. It handles patient engagement for hospitals, physician groups and revenue-cycle and collections companies, sending bills by post, email and text and running online payment portals. Patients usually know the hospital or practice that billed them rather than RevSpring, so a RevSpring notice letter may be the first time many people see the name.
What is known
- The Vermont listing is dated November 4, 2026.
- It lists 569 Vermont residents and names Social Security numbers as the data type.
- Vermont requires a preliminary notice to the Attorney General within 14 business days of discovering a breach, and consumer notices within 45 days.
What is not known
- How the breach happened, and whether it was a cyberattack, a vendor incident or an error.
- When it happened and when RevSpring discovered it.
- The national total, and which healthcare clients' patients are involved.
- Whether health or billing details were also exposed. The Vermont listing names only Social Security numbers.
Vermont no longer posts copies of consumer letters, so the notice text is not public. This is separate from a 2023 RevSpring incident in which about 3,000 patients received misprinted statements showing other patients' information.
Who is at risk
People who received medical bills through RevSpring, usually without knowing it. A Social Security number with a name is enough for identity theft: new credit accounts, tax-refund fraud and fraudulent benefit claims. Because RevSpring handles bills, expect fake "past due" notices and payment links.
What to do
- Read any letter from RevSpring or your healthcare provider and enrol in any credit monitoring offered.
- Freeze your credit with Equifax, Experian and TransUnion. It is free and is the most effective protection against new-account fraud.
- Get an IRS Identity Protection PIN to block tax-refund fraud.
- Pay medical bills only through your provider's own portal or a phone number from a statement you already trust, never through a link in an unexpected text or email.
- Check your credit reports at annualcreditreport.com over the coming months.
Sources
- Vermont Attorney General, Security Breach Notices (listing dated November 4, 2026)
- Claim Depot, RevSpring investigation page
- Strauss Borrelli PLLC, November 5, 2026
Sourcing note: the only official record is the Vermont listing. The other sources are law-firm pages seeking clients and add no confirmed facts. This post will be updated if RevSpring or another state publishes more.