Healthcare Therapy Services, Inc. (HTS), a provider of physical, occupational, and speech therapy in Indiana, experienced a cybersecurity incident where an unauthorized individual accessed its network and potentially acquired personally identifiable information (PII) and protected health information (PHI). The compromised data includes names combined with drivers’ license numbers, financial account details, medical records, and Social Security numbers of an unknown number of individuals. The breach has prompted a class-action investigation by Lynch Carpenter, LLP, as affected individuals may be entitled to compensation due to the exposure of highly sensitive personal and financial data. The incident poses significant risks, including identity theft, financial fraud, and unauthorized medical data misuse, given the nature of the stolen information. HTS has not disclosed the exact scope or method of the breach, but the involvement of PII and PHI suggests a severe compromise of patient confidentiality and trust.

On April 29, 2025, Healthcare Therapy Services (HTS), a Midwest and Southern U.S.-based provider of physical, occupational, and speech therapy, detected a cyberattack compromising its internal email systems. A forensic investigation confirmed the exposure of personal and protected health information (PHI), including names, Social Security numbers, medical records, driver’s licenses, and financial account details of patients and employees. The breach was formally disclosed on September 9, 2025, with notifications sent to affected individuals by November 7, 2025, including filings with the Massachusetts Attorney General. The incident poses severe risks of identity theft, medical fraud, and financial fraud, though the exact number of victims remains undisclosed (potentially thousands). HTS responded by engaging cybersecurity experts, offering 24 months of free credit monitoring (IDX), $1M identity theft insurance, and recovery assistance, and establishing a dedicated call center for inquiries. The breach underscores critical vulnerabilities in healthcare data security, with long-term reputational and operational consequences for HTS.