Nationwide Recovery Service Hack Grows to 500,000 Victims

The list of healthcare sector clients reporting large health data breaches from the 2024 hack on debt collection firm Nationwide Recovery Service continues to grow, as does the number of affected patients throughout the United States.

See Also: Flip the Security Model for Regulated Data Protection

At least a half dozen more NRS clients have reported breaches tied to the hack to federal and state regulators in recent weeks, adding more than another 200,000 patients to the list of affected individuals, which now totals more than a half-million people, so far.

Georgia-based NRS reported the hacking incident to the U.S. Department of Health and Human Services in September 2024 as affecting 501 individuals, a placeholder estimate. As of Thursday, that NRS report still did not yet appear to be updated on the HHS’ Office for Civil Rights’ HIPAA Breach Reporting Tool website of major health data breaches affecting 500 or more individuals.

NRS did not immediately respond to Information Security Media Group’s request for additional details about the hack and the total numbers of clients and people affected.

As of mid-May, it appeared that more than 300,000 patients had been affected by NRS’ hack based on breach reports submitted by NRS clients (see: Debt Collector Hack Affects Long List of Clients, Patients).

Those earlier victims include 210,000 patients of Harbin Clinic in Georgia and nearly 90,000 patients of Texas-based Vitruvian Health, also known as Hamilton Health Care, as well as several other firms in healthcare and other sectors.

Since then, several other NRS clients have reported large breaches to HHS and state regulators involving the hack including:

In addition to those, Oregon-based TRG Imaging reported to Texas’ attorney general last week that 257 of their Texans patients were affected. TRG also submitted breach reports to other state regulators, including California’s attorney general, but so far the imaging firm has not disclosed the total number of people affected by the NRS hack. TRG’s breach has also not yet shown up on the HHS OCR website.

Also, Oklahoma-based Duncan Regional Hospital in recent weeks has been notifying an unspecified number of patients who were affected by the NRS incident, but so far a DRH breach report has not yet been posted on the HHS OCR website.

Frequent Targets

Breaches stemming from the NRS hack is of course among a long and growing list of other major health data breached reported so far this year involving business associates that handle large volumes of protected health information.

With the year nearly half over, the HHS OCR website as of Wednesday shows a total of 336 reported major health data breaches affecting nearly 29.2 million people so far in 2025.

Of those, business associates were reported to be involved in 124 incidents affecting more than 15.2 million people, or about half of the people affected by major health data breaches so far in 2025.

“Third parties, business associates and general supply chain vendors have trust relationships with covered entities in the healthcare sector, and sometimes direct access into their networks and systems,” said Mike Hamilton, field CISO at security firm Lumifi Cyber.

Some hold and process records on behalf of dozens or even hundreds of covered entities, he said.

“Because of this, many times they are the ‘unlocked window’ into which criminals can gain access to the covered entity, or compromise those third parties directly for records,” he said.

“Criminal gangs are known to research business associate relationships and understand the leverage they have in obtaining records for extortion – if disclosed – a class action suit will be immediately filed. They thus set the extortion demand below the threshold of a calculated assumption of the magnitude of the suit.”

As of Thursday, NRS was already facing about a dozen proposed federal class action lawsuits related to the company’s hacking incident.

NRS clients affected by the debt collector’s hacking incident have said in their breach notification statements that an “unauthorized party” gained access to the NRS’ computer network between July 5 and July 11, 2024, acquiring copies of certain files and folders from NRS’ systems during that time.

Information contained in the compromised files and folders potentially included individuals’ names, addresses, Social Security numbers, date of birth, account balance and medical related information NRS collected in connection with debt payment services they provide to clients.

NRS clients have been telling affected individuals that the hackers in the NRS incident did not gain access to any of the clients’ own IT systems.

Medical debt collection firms like NRS handle a combination of health and financial data making them especially attractive targets for threat actors, Hamilton said. “Those records are highly monetizable on the darkweb,” he said. “This would include not only debt collection firms but payment processors and insurance companies,” he added.