Almeida Law Group is investigating a data breach at Credit Control Corporation. If you were affected, contact Almeida Law Group.
About Credit Control Corporation
R&B Corporation of Virginia, doing business as Credit Control Corporation (CCC), is a debt collection agency headquartered in Newport News, Virginia. Founded in 1953, the company specializes in healthcare, utility, and commercial collections and serves as a business associate of many hospitals and doctor’s offices, collecting unpaid medical bills on their behalf. Because CCC handles accounts on behalf of medical providers, its files may contain sensitive personal and financial information tied to patients’ healthcare accounts.
What Happened?
Credit Control Corporation was listed in a Vermont Attorney General consumer breach notice filed on June 13th, 2026. The notice relates to a data security incident that originally occurred between March 2nd, 2023, and March 7th, 2023. On March 7th, 2023, CCC detected unusual activity involving certain systems within its network. With the assistance of third-party forensic specialists, CCC determined by approximately March 14th, 2023, that certain files had been copied from its network during that period. The types of information potentially involved included names, addresses, Social Security numbers, account numbers, account balances, and dates of service; in some cases, driver’s license numbers were also referenced as compromised. CCC has stated it has no evidence that affected individuals’ information was actually copied, but cannot rule out the possibility. The June 13th, 2026, Vermont AG filing appears to represent a supplemental notification wave sent on behalf of CCC’s business partner entities, rather than a new or separate incident. CCC is offering one year of complimentary credit monitoring and identity theft restoration services through Kroll to affected individuals.
The March 2023 breach previously affected approximately 286,700 to 345,523 individuals across all notifications, based on Maine AG filings and HHS Office for Civil Rights reporting. A consolidated class action lawsuit (Case No. 4:23-cv-0066, U.S. District Court for the Eastern District of Virginia) resulted in a $1.61 million settlement, which received final court approval from Judge Jamar K. Walker on January 29th, 2025. Class members could claim up to $2,000 in reimbursement for documented out-of-pocket losses, and CCC agreed to implement additional security controls as part of the settlement. Separately, in June 2025, a threat actor claimed on a data leak forum to possess CCC data on 9.1 million Americans; CCC denied any current breach in response, and that claim has not been independently confirmed.
Key Facts at a Glance
- Company or Organization: R&B Corporation of Virginia d/b/a Credit Control Corporation
- Industry: Debt collection / Financial services (healthcare and commercial focus)
- Location: Newport News, Virginia
- Incident type: Unauthorized file copying from company network
- Date of breach: March 2nd, 2023 – March 7th, 2023
- Date breach discovered: March 7th, 2023
- Date of consumer notification: June 13th, 2026 (supplemental notification wave; original notifications began May 15th, 2023)
- Total persons affected: Approximately 286,700 to 345,523 individuals (prior notifications)
- Identity theft protection offered: One year of complimentary credit monitoring and identity theft restoration through Kroll
- Prior breach: March 2023 incident (same event); June 2025 attacker claim of separate breach (unconfirmed, denied by CCC)
- Litigation status: Class action settlement of $1.61 million received final approval January 29th, 2025 (Case No. 4:23-cv-0066, E.D. Va.)
- Source: Vermont Attorney General consumer breach notice (https://ago.vermont.gov/document/2026-06-13-credit-control-corporation-data-breach-notice-consumers); HIPAA Journal (https://www.hipaajournal.com/credit-control-corporation-va-data-breach/); Shub Johns & Holbrook settlement details (https://shublawyers.com/current-cases/1-61m-credit-control-corporation-settlement-reached-in-data-breach-class-action/); DataBreaches.net (https://databreaches.net/2025/06/16/credit-control-corporation-data-allegedly-from-9-1-million-consumers-listed-for-sale-on-forum/)
What Should You Do?
If you received a notice from Credit Control Corporation, enroll in the complimentary Kroll identity monitoring services as soon as possible by visiting https://enroll.krollmonitoring.com and following the instructions provided in your notification letter. You should also place a fraud alert or credit freeze with the three major credit bureaus—Equifax, Experian, and TransUnion—to help prevent unauthorized accounts from being opened in your name. Review your account statements and credit reports carefully for any suspicious activity; you can access free credit reports from all three bureaus at AnnualCreditReport.com. Because the compromised data may include Social Security numbers and account information tied to medical providers, also review any Explanation of Benefits statements from your health insurer and check your medical records for services you did not receive. If you discover signs of identity theft, report them at IdentityTheft.gov, which provides a personalized recovery plan.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
