Patients of healthcare providers that use RevSpring’s online bill pay platform received notice of a breach in which an intruder used a RevSpring support tool between May 15 and June 1, 2026 to obtain names, contact details, birth dates and Social Security numbers. No lawsuit or settlement has been reported, so there is nothing to claim; RevSpring is offering free identity monitoring through Kroll.
What Happened?
RevSpring, Inc. is a technology services company that runs the online bill pay platform some healthcare providers offer their patients. According to the notice letter RevSpring filed with the California Attorney General on November 4, 2026, the company discovered on August 17, 2026 that an unauthorized person may have gained access to a RevSpring support tool that could be used to look up information about patients who used the bill pay platform.RevSpring says its investigation found the person used the support tool successfully between May 15 and June 1, 2026 to obtain information about patients of certain healthcare providers. The company says it brought in outside cybersecurity experts and notified law enforcement. It has not publicly said how many patients or which providers were affected; each letter names the patient’s own provider.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Information Was Involved?
RevSpring says the information involved varies by person but may include name, home address, email address, phone number, date of birth, Social Security number and location of service, which is information gathered as part of its back-end bill pay services.The company says the accessed information did not include details of medical care such as diagnoses or treatment, and that no debit or credit card numbers or bank account information was involved. It also says the incident did not touch the healthcare provider’s own systems or anyone’s electronic medical record.
Why Patients May Not Recognize the Name
Many patients pay a medical bill through a portal that carries their doctor’s or hospital’s branding without knowing a vendor runs it. RevSpring’s letter explains that it provides the online bill pay platform “used by one of your healthcare providers” and names that provider in each letter. A patient who receives a RevSpring notice may therefore have had no direct relationship with the company.What RevSpring Says It Is Doing
RevSpring says it has added new technical safeguards on top of its existing cybersecurity tools. It is offering identity monitoring at no cost through Kroll, including single-bureau credit monitoring, fraud consultation and identity theft restoration, for a term stated in each letter. Enrollment uses an activation code and verification ID printed in the letter, and each letter gives its own activation deadline.Is There a Lawsuit?
No class action over the RevSpring incident has been reported as of November 6, 2026, and there is no settlement or claim form. Any complaint would make allegations that RevSpring could contest. OCA will update this page if one is filed.Questions
What is RevSpring?
RevSpring is a technology services company that runs the online bill pay platform some healthcare providers use to let patients pay their bills. Patients may never have dealt with RevSpring directly; its notice letters name the patient’s healthcare provider.
What information was exposed in the RevSpring breach?
RevSpring says the information varies by person but may include name, home address, email address, phone number, date of birth, Social Security number and location of service. It says the data did not include diagnosis or treatment details, and no debit or credit card numbers or bank account information was involved.
Were medical records accessed in the RevSpring breach?
No, according to RevSpring. Its letter says the incident did not involve the healthcare provider’s own systems or access to electronic medical records.
Is there a RevSpring data breach lawsuit or settlement?
No lawsuit or settlement over the RevSpring incident has been reported as of November 6, 2026, so there is nothing to claim. RevSpring is offering free identity monitoring through Kroll to people who received a notice letter.
Which healthcare providers used RevSpring?
RevSpring’s public notice does not list them. Each individual letter names the healthcare provider whose bill pay platform was involved.
Sources
• California Attorney General, Submitted Breach Notification Sample: RevSpring, Inc. (reported November 4, 2026)• RevSpring, “Notice of Data Breach” patient letter (PDF, filed with the California Attorney General)
