Almeida Law Group is investigating a data breach at RevSpring, Inc. The breach occurred on May 15th, 2026. If you were affected, contact Almeida Law Group.
About RevSpring, Inc.
RevSpring, Inc. is a healthcare engagement and payment solutions company headquartered in Nashville, Tennessee. It provides online bill pay platforms, patient communication, billing, and revenue-cycle solutions for hospitals, health systems, and payers. Founded in various forms since 1981 and formally consolidated in 2012, RevSpring functions as a technology vendor and subprocessor for healthcare organizations, meaning it handles patient billing data on behalf of its healthcare provider clients.
What Happened?
RevSpring, Inc. was listed in a California Attorney General sample breach notice filed on November 4th, 2026. According to RevSpring’s own breach notice, an unauthorized person gained access to a RevSpring support tool and used it between May 15th, 2026 and June 1st, 2026 to obtain patient information from RevSpring’s bill pay platform. The unauthorized access was discovered on August 17th, 2026. RevSpring engaged outside cybersecurity experts and notified law enforcement. The company retained Kroll to provide identity monitoring services to affected individuals at no cost.
The information involved may include name, home address, email address, phone number, date of birth, Social Security number, and/or location of service. The breach notice explicitly states that the incident did not involve access to electronic medical records, did not include details about medical care such as diagnosis or treatment information, and did not involve debit or credit card numbers or bank account information.
The total number of individuals affected nationally has not been publicly disclosed. No ransomware group claim or threat actor attribution has been identified in public sources. At least two law firms — Shamis & Gentile P.A. and Strauss Borrelli PLLC — announced investigations into the breach on November 5th, 2026 on behalf of potentially affected individuals, and ClassAction.org listed the RevSpring breach among featured recent data breaches as of November 2026, though no class action lawsuit has been filed as of that date. RevSpring also has a prior breach history, with cybersecurity incidents disclosed in 2014 and 2023; the 2023 incident, filed by Waystar, Inc. as a RevSpring customer, affected 1,706 individuals and involved breach dates of October 24th, 2023 through October 26th, 2023.
Key Facts at a Glance
- Company or Organization: RevSpring, Inc.
- Industry: Healthcare technology / Healthcare billing and payment solutions
- Location: Nashville, Tennessee
- Incident type: Unauthorized access to a support tool used to obtain patient information from bill pay platform
- Date of breach: May 15th, 2026 – June 1st, 2026
- Date breach discovered: August 17th, 2026
- Date of consumer notification: November 4th, 2026
- Identity theft protection offered: Yes — Kroll identity monitoring (credit monitoring, fraud consultation, and identity theft restoration)
- Prior breach: Yes — incidents disclosed in 2014 and 2023; 2023 incident affected 1,706 individuals
- Litigation status: No class action filed; investigations announced by Shamis & Gentile P.A. and Strauss Borrelli PLLC as of November 5th, 2026
- Source: California Attorney General – Data Breach Report; California AG Breach Notice PDF; Maine Attorney General – RevSpring 2023 Filing; Board Cybersecurity – RevSpring Tracker; ClaimDepot – Shamis & Gentile Investigation; Strauss Borrelli – RevSpring Investigation
What Should You Do?
If you received a notice from RevSpring, enroll in the free Kroll identity monitoring services as soon as possible — visit Enroll.krollmonitoring.com/redeem and use the unique code and Verification ID provided in your notice before your activation deadline. Whether or not you received a notice, consider placing a fraud alert or credit freeze with the three major credit bureaus (Equifax, Experian, and TransUnion) to help prevent new accounts from being opened in your name. Review your credit reports for any unfamiliar activity at AnnualCreditReport.com, where you are entitled to free reports from each bureau. Monitor your financial account statements for suspicious charges and report anything unusual to your financial institution promptly. If you believe your identity has already been misused, visit IdentityTheft.gov for a personalized recovery plan.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
