---
title: "RevSpring bill-pay support-tool incident"
description: "RevSpring reported that an unauthorized person used a support tool to obtain information about patients who used its healthcare bill-payment platform between May 15 and June 1, 2026."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-06"
canonical_url: "https://www.ally.security/incidents/revspring-bill-pay-support-tool-incident-2026"
markdown_url: "https://www.ally.security/incidents/revspring-bill-pay-support-tool-incident-2026.md"
stix_url: "https://www.ally.security/incidents/revspring-bill-pay-support-tool-incident-2026/stix.json"
---

# RevSpring bill-pay support-tool incident

RevSpring reported that an unauthorized person used a support tool to obtain information about patients who used its healthcare bill-payment platform between May 15 and June 1, 2026.

Last modified Nov 6, 2026 · 1 source

## Summary

- **Environment:** Healthcare bill-payment support tool
- **Operational impact:** Patient information obtained through a support tool
- **Financial impact:** No incident cost publicly quantified

## What happened

[RevSpring](https://revspringinc.com/) reported that an unauthorized person used a support tool to obtain information about patients who used its healthcare bill-payment platform between May 15 and June 1, 2026. [1](#source-1)

## Impact

Information varied by person and could include names, addresses, emails, phone numbers, birth dates, Social Security numbers and locations of service. [1](#source-1)

RevSpring said the incident did not involve providers’ own environments or electronic medical records. Diagnosis and treatment details, payment-card numbers and bank-account information were excluded. [1](#source-1)

## Timeline

### May 15, 2026 — Reported support-tool access began

Reported support-tool access began, as described in the [incident notice](https://oag.ca.gov/system/files/RevSpring_California%20Notification.pdf). [1](#source-1)

### June 1, 2026 — Reported support-tool access ended

Reported support-tool access ended, as described in the [incident notice](https://oag.ca.gov/system/files/RevSpring_California%20Notification.pdf). [1](#source-1)

### August 17, 2026 — Possible unauthorized access discovered

Possible unauthorized access discovered, as described in the [incident notice](https://oag.ca.gov/system/files/RevSpring_California%20Notification.pdf). [1](#source-1)

### November 6, 2026 — Briefing updated

This briefing was last reviewed and updated on November 6, 2026.

## Threat Group & Attack Vector

An unauthorized person used RevSpring’s support tool to obtain patient information. The notice does not explain how the person first obtained access to that tool. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

RevSpring discovered the possible access on August 17, investigated with outside experts, notified law enforcement and added safeguards. It offered identity monitoring; the public template leaves the duration and individual notification date blank. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/revspring-bill-pay-support-tool-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### RevSpring — Notice of Data Security Incident

official · RevSpring

<https://oag.ca.gov/system/files/RevSpring_California%20Notification.pdf>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: Information varied by person and could include names, addresses, emails, phone numbers, birth dates, Social Security numbers and locations of service.
2. **Resulted In · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: RevSpring discovered the possible access on August 17, investigated with outside experts, notified law enforcement and added safeguards. It offered identity monitoring; the public template leaves the duration and individual notification date blank.
3. **Affected Organization · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: RevSpring
4. **Resulted In · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: RevSpring reported that an unauthorized person used a support tool to obtain information about patients who used its healthcare bill-payment platform between May 15 and June 1, 2026.
5. **Occurred At · 100% confidence · current**  
   Reported support-tool access began: 2026-05-15
6. **Occurred At · 100% confidence · current**  
   Possible unauthorized access discovered: 2026-08-17
7. **Resulted In · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: RevSpring said the incident did not involve providers’ own environments or electronic medical records. Diagnosis and treatment details, payment-card numbers and bank-account information were excluded.
8. **Resulted In · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: Possible unauthorized access discovered
9. **Discovered At · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: 2026-08-17
10. **Resulted In · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: Reported support-tool access ended
11. **Occurred At · 100% confidence · current**  
   Reported support-tool access ended: 2026-06-01
12. **Resulted In · 100% confidence · current**  
   RevSpring bill-pay support-tool incident: Reported support-tool access began

</details>