RevSpring data breach investigation (healthcare bill pay support tool, 2026)

RevSpring, a Nashville company that runs online bill pay for healthcare providers, says an unauthorized person used one of its internal support tools between May 15 and June 1, 2026, to pull information about patients who used its bill pay platform. The information may include names, home addresses, email addresses, phone numbers, dates of birth, Social Security numbers and where people received care.

RevSpring says it discovered the problem on August 17, 2026. It began filing notices with state attorneys general on November 4, 2026, and is offering free identity monitoring through Kroll.

At least two law firms, Levi & Korsinsky and Cole & Van Note, say they are investigating possible claims. Class Action Pulse found no lawsuit filed as of November 6, 2026, and there is no settlement or claim form.

RevSpring, Inc. describes itself in its notice letter as a technology services company that provides the online bill pay platform used by healthcare providers. Law firm summaries describe it as a healthcare engagement and payment company that handles patient communication, billing and revenue-cycle work for providers and payers. Its notice lists an office at 1131 4th Avenue South in Nashville, Tennessee.

Patients usually do not sign up with RevSpring themselves. They reach its platform when they pay a medical bill online for one of RevSpring's clients. Each letter names the healthcare provider whose patients were involved, which helps readers who do not recognize RevSpring's name.

Healthcare providers are RevSpring's clients. RevSpring says the incident did not involve any provider's own computer systems or electronic medical records. It has not publicly listed which providers were affected.

Kroll is the company RevSpring hired to provide identity monitoring to people who received letters.

State attorneys general collect breach notices. The California Attorney General posted RevSpring's sample letter, listing the breach dates as May 15 to June 1, 2026. The Vermont Attorney General lists a November 4, 2026, report covering 569 Vermont residents, with Social Security numbers involved. The sample letter says 216 Rhode Island residents were affected.

Law firms Levi & Korsinsky and Cole & Van Note have posted investigation pages inviting affected people to contact them.

According to RevSpring's notice letter and state filings:

• May 15 to June 1, 2026: An unauthorized person successfully used a RevSpring support tool to obtain information about patients of RevSpring's healthcare provider clients.
• August 17, 2026: RevSpring discovered that someone may have gained access to the tool. It says it promptly began an investigation, hired outside cybersecurity experts and notified law enforcement.
• After discovery: RevSpring informed affected healthcare providers. The date varies by provider and is filled in on each letter.
• November 4, 2026: RevSpring filed notices with the California and Vermont attorneys general.
• November 5, 2026: Law firm investigation announcements appeared.

The letter does not say how the unauthorized person got access to the support tool. By RevSpring's own dates, about 11 weeks passed between the last known access and discovery, and about 11 more before notices were filed with the states. RevSpring has not explained the timing publicly.

RevSpring says the information involved varies by person but may include name, home address, email address, phone number, date of birth, Social Security number and location of service. It says the accessed information did not include medical care details such as diagnosis or treatment, and that no debit card, credit card or bank account numbers were involved. It says it has added new technical safeguards and is offering Kroll identity monitoring at no cost.

RevSpring has not publicly stated the total number of people affected.

The investigating law firms say they are investigating the incident and whether affected people may have legal claims. Levi & Korsinsky's page lists possible data categories, including financial and health information, that go beyond what RevSpring's letter describes. Class Action Pulse relies on RevSpring's own letter for the data types.

No court has heard from either side, because no lawsuit has been found.

No court is involved yet. Class Action Pulse found no complaint against RevSpring over this incident as of November 6, 2026.

No one has found that RevSpring was negligent or that anyone is owed money. Law firm investigations do not mean a lawsuit will be filed or succeed.

There is no class. If a case is filed, it would likely focus on people who meet these points:

• Notice: You received a RevSpring breach letter in or after November 2026.
• Bill pay link: You are a patient of a healthcare provider whose online bill pay ran on RevSpring's platform.
• Data exposed: Your information was obtained through the support tool between May 15 and June 1, 2026.
• Sensitive data: People whose Social Security numbers were involved may face more risk.

A future court would set the actual definition.

1. Read the letter closely. It names your provider, your Kroll activation code and your enrollment deadline.
2. Enroll in Kroll monitoring. Use the code at enroll.krollmonitoring.com/redeem before the deadline in your letter.
3. Freeze your credit. A security freeze at Equifax, Experian and TransUnion is free and makes it harder for someone to open accounts in your name.
4. Check reports and statements. Free weekly credit reports are available at annualcreditreport.com. Review bills from your healthcare providers for charges you do not recognize.
5. Watch for scams. Because email, phone and location of service may be involved, be careful with unexpected messages about medical bills. Pay through a link you already trust.
6. Ask questions. RevSpring's call center is (844) 971-8621, Monday through Friday, 8:00 a.m. to 5:30 p.m. Central Time.
7. Send an inquiry if you want. The form on this page sends your details to Class Action Pulse. It does not start a lawsuit.

No cash is available. There is no settlement or claim process.

The current benefit is free Kroll identity monitoring, which includes single-bureau credit monitoring, fraud consultation and identity theft restoration. The length of coverage is filled in on each letter. Any money would require a lawsuit and a court-approved settlement or judgment.

• May 15 to June 1, 2026: Period of unauthorized access.
• August 17, 2026: Discovery.
• November 4, 2026: State filings.
• Your Kroll deadline: Listed in your letter.

Data breach claims have time limits that vary by state. The FTC's identitytheft.gov site lets you report and recover from identity theft.

Support tool: Software a company's staff uses to look up account details, for example to help a customer. RevSpring has not described its tool further.

Location of service: The place where you received healthcare, such as a clinic or hospital.

Security freeze: A free block on your credit file that stops most lenders from viewing it until you lift it.

Fraud alert: A note on your credit file telling lenders to verify your identity before opening new credit.

Identity monitoring: A service that alerts you to changes in your credit file and helps if fraud occurs.

Class action investigation: A law firm's review of whether a group lawsuit is possible. It is not a lawsuit.

More state filings may reveal how many people were affected and which providers were involved. Law firms may file a lawsuit, and if several are filed they could be combined.

Class Action Pulse will update this page if a lawsuit, total count or settlement appears.

This article relies on RevSpring's sample notice posted by the California Attorney General, the Vermont Attorney General's breach listing, and investigation pages from Levi & Korsinsky and Cole & Van Note.

The total number of people affected, the healthcare providers involved, how access was gained and the length of Kroll coverage are not public. The Vermont and Rhode Island counts are single-state figures. No lawsuit has been confirmed.

Class Action Pulse is not a law firm or settlement administrator and does not guarantee eligibility or payment. This article is general information, not legal advice.