Averhealth/Avertest Email Data Incident (2025-2026)
The 2025 Averhealth and Avertest email data incident is the officially notified event in which an unauthorized party accessed the Avertest email environment or network from December 19, 2025, through January 21, 2026.
The affected total is not confirmed, so severity cannot be determined from a record count alone.
Exposed Data Types
9 sensitive17- Patient account information
- Clinical information
- Diagnosis information
- Medical costs
- Medical histories
- Medical providers
- Medical record numbers
- Treatments and procedures
- Mental and physical conditions
- Names
- Dates of birth
- Driver licenses
- Electronic signatures
- Social security numbers
- Minor status
- Insurance policy numbers
- Dates of service
About This Breach
Averhealth identified unusual activity on January 20 and secured the environment; the review window extending to January 21 must not be explained as assumed continued access.
HHS OCR reports 9,909 affected people. This is a regulatory notification population, not emails, local dataset rows, or proof that every field occurred for every person. On May 6, the organization determined that files may have been accessed or acquired and sent notices around July 2; no person or health data is locally imported.
Person-variable fields are names, dates of birth, driver’s licences, electronic signatures, SSNs, minor status, patient-account data, clinical or diagnosis information, insurance-policy numbers, medical costs, dates of service, histories, providers, record numbers, treatment or procedures, and mental or physical conditions. Cards and bank accounts are excluded.
The notice does not establish identity, Averhealth or Avertest patient or client status, substance-use testing, court supervision, treatment-program participation, minor status, a diagnosis, test result, or provider relationship, field co-occurrence, or misuse. The person’s own letter controls individual scope.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
