Debt Collector Hack Affects Long List of Clients, Patients

A 2024 hacking incident at Nationwide Recovery Service, a third-party debt collection firm, has affected a long and growing list of clients and at least hundreds of thousands of individuals so far.

See Also: Top 10 Technical Predictions for 2025

Victims include 210,000 patients of Harbin Clinic in Georgia and nearly 90,000 patients of Texas-based Vitruvian Health, also known as Hamilton Health Care, as well as numerous other firms in the healthcare and other sectors.

Harbin Clinic, in a breach report to Maine’s attorney general on Friday, said the NRS hacking incident affected 210,140 individuals, but did not involve Harbin Clinic’s own IT systems.

“NRS is a third-party vendor that has provided debt collection services for delinquent accounts of individuals treated at Harbin Clinic, as well as services related to bankruptcies, lawsuits and patient estate matters,” Harbin Clinic said in a sample breach notification statement.

“It is our understanding that, in July 2024, NRS discovered suspicious activity related to its information technology systems, which resulted in a network outage,” Harbin said. NRS’ investigation determined that there was unauthorized access to the NRS network between July 5, 2024, and July 11, 2024, “during which time certain files and folders were illegally copied from NRS’s systems by someone without authorization,” Harbin said.

“NRS reported it began a lengthy review to determine what information was contained on the impacted NRS systems and which NRS clients were impacted.”

NRS told Harbin that the affected individuals include guarantors listed on patient accounts, as well patients. Information potentially compromised includes names, addresses, Social Security numbers, dates of birth and financial account information, Harbin said.

Similarly, Vitruvian Health reported the NRS incident to Maine’s attorney general on April 15 as affecting 88,848 patients, also saying that none of Virtruvian’s own IT systems were compromised.

Among Virtruvian entities affected in the NRS incident are Hamilton Health Care System and its affiliates Hamilton Emergency Medical Services, Hamilton Physician Group, Hamilton Medical Center and Anna Shaw Children’s Institute. Information potentially compromised includes names, addresses, Social Security numbers, dates of birth, financial account information and other medical information.

In recent weeks several other healthcare entities – as well as NRS clients in other sectors – also have issued breach notices or submitted breach reports to regulators related to the incident.

That includes several other healthcare organizations that have filed breach reports to the U.S. Department of Health and Human involving the NRS hack.

Among those so far are Northeast Georgia Health System, which reported to HHS on April 8 that the NRS hacking incident affected 21,000 patients, and Rhea Medical Center in Tennessee, which reported the NRS incident to HHS on April 10 as affecting 8,309 individuals.

Several other organizations also issued breach notification statements about the NRS incident, including Smile Solutions of Goodlettsville, Tennessee; Providence Swedish – formerly Stevens Memorial Hospital – in Washington State, and Erlanger, formerly Murphy Medical Center, in North Carolina.

As of Monday, breach reports involving those entities had not yet appeared posted on the HHS OCR HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.

Among other NRS client affected is the City of Chattanooga, Tennessee. The city says 836 customers who used city services were affected by the hack and said it is considering filing a lawsuit against NRS.

Tennessee-based NRS reported the hacking incident to HHS OCR on Sept. 9, 2024, as affecting 501 individuals, an apparent placeholder estimate.

NRS did not immediately respond to Information Security Media Group’s request for details about its hacking incident, including the total number of clients and individuals affected.

As of Monday, NRS was already facing several proposed federal class action lawsuits involving the hacking incident, including litigation in which the debt collector is named a co-defendant along with an affected client.

One such lawsuit, filed on April 22 against NRS and Vitruvian, alleges among other claims that the entities were negligent in failing to safeguard plaintiffs’ and class members’ sensitive information from cybercriminals.

Debt Collector Hacks

NRS is not the first national debt collector to experience a hacking incident that affected legions of clients and consumers, including those in the healthcare sector.

American Medical Collection Agency in 2018 experienced a hacking incident that compromised the personal and health data of 21 million people, resulted in regulatory enforcement actions, civil lawsuits and ultimately pushed the company to file for bankruptcy (see: Debt Collection Firm Reaches Breach Settlement with States).

“Hacking incidents involving debt collection firms like Nationwide Recovery Services pose a dual-layered risk to both the firms’ clients – such as healthcare providers – and the consumers whose personal and financial data is collected, stored and often retained long after the engagement ends,” Ensar Seker said, CISO at security firm SOCRadar.

For the clients, these breaches create regulatory exposure, reputational damage and a breakdown of patient trust, even when the breach occurs outside their own infrastructure, he said. “Patients don’t make a distinction between the provider and the third party. If their data is stolen, they hold the clinic accountable. The long notification delays, as seen in the NRS case, only amplify this impact.”

‘A Goldmine for Cybercriminals’

For consumers, the risks are particularly severe, he said. “Debt collection firms often retain a rich combination of data: full names, Social Security numbers, outstanding balances, legal case details, contact history and sometimes even protected health information,” he said.

“This kind of information is a goldmine for cybercriminals engaged in identity theft, medical fraud and targeted social engineering,” he said. “It allows attackers to craft convincing scams, exploit credit histories or reroute insurance claims.”

Debt collection agencies are attractive targets for several reasons. “First, they handle high-value, high-volume datasets but often lack the security maturity of the healthcare or financial sectors they serve,” Seker said.

“Second, they’re part of the back-end administrative chain, which is usually overlooked in terms of cybersecurity investment. Third, the nature of their work – handling bankruptcies, estates, litigation – means they store sensitive information that criminals can monetize quickly,” he said.

“These firms are often under the radar until a breach happens, but they should be considered critical infrastructure within the healthcare financial supply chain.”

Erich Kron, a security awareness advocate at security firm KnowBe4, offers a similar perspective.

“Debt collection firms such as NRS collect quite a bit of very sensitive information that could be used by bad actors in social engineering attacks and scams,” he said.

“If an attacker knows exactly when and where a person had a medical procedure, they can use that information to convince their target that they are legitimate and can then use that trust to persuade individuals to pay for false services, steal credit card information, or to gather more information,” he said.

For example, a bad actor could call a person and tell them that they had a procedure on a specific day that is known from the stolen information, and tell them that they still owe some amount, he said.

From there they could either take the money or steal credit card information, but because they referenced a real event and knew details about it, the victims may never realize they were scammed.

“The clinic and NRS may be facing significant fines from regulatory bodies for the loss of patient information,” he said. “With healthcare being such a highly regulated industry, the impact on the organizations involved is likely to be more than just a loss of reputation with their customers.”