TrueRCM 2025 Data Breach (1.2 Thousand People Affected)

The 2025 TrueRCM data breach was a cyber incident involving unauthorized access to the network environment of a company that provides medical-billing services to healthcare organizations. The official notice says the unauthorized party acquired certain personal information on November 21, 2025.

The U.S. Department of Health and Human Services Office for Civil Rights recorded the event as a hacking/information-technology incident involving TrueRCM as a business associate and reported 1,247 affected individuals.

Verified Incident Timeline

TrueRCM detected the network-security incident on or about November 24, 2025, and began an investigation with outside forensic specialists. According to the official sample letter sent on behalf of Comprehensive Rehab Consultants, the unauthorized party acquired some information on November 21. The investigation was still underway when the letter was published on March 13, 2026.

What Information May Have Been Affected?

The scope may vary by person. The official sample letter lists first and last names, addresses, dates of birth, Social Security numbers, driver's-license or state-identification numbers, admission dates, diagnosis information, care providers, and treatment facilities. The same letter says claims data, payment cards, and other financial information were not exposed.

How the Organization Responded

TrueRCM says it investigated with outside specialists, secured its network environment, wiped and rebuilt affected systems, and strengthened network security. The company also reviewed policies, procedures, and security software and notified the FBI. The notice says there was no evidence at that time that the information had been specifically misused.

What Should Affected People Do?

Notice recipients should monitor credit reports and healthcare records for an unfamiliar transaction or service. People whose Social Security, driver's-license, or state-identification information was affected may consider a free fraud alert or credit freeze based on their circumstances.