Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with forensic investigation firm, and containment measures with secured affected email accounts, and remediation measures with engaged third-party forensic investigation, remediation measures with reviewed affected patients and compromised data, remediation measures with issued notification letters to affected individuals, and recovery measures with offered complimentary credit monitoring & identity protection services, and communication strategy with posted consumer notice on website, communication strategy with notified u.s. department of health and human services (hhs), communication strategy with established dedicated helpline (855-291-2518)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Phishing Emails (Vendor Employee Credentials).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Pii (Personally Identifiable Information), Phi (Protected Health Information) and .

Third-Party Assistance: The company involves third-party assistance in incident response through Forensic Investigation Firm, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Engaged Third-Party Forensic Investigation, Reviewed Affected Patients and Compromised Data, Issued Notification Letters to Affected Individuals, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by secured affected email accounts and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Offered Complimentary Credit Monitoring & Identity Protection Services, .

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Innovative Physical Therapy Consumer Notice, and Source: U.S. Department of Health and Human Services (HHS) Breach NotificationDate Accessed: 2025-10-02.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Posted Consumer Notice On Website, Notified U.S. Department Of Health And Human Services (Hhs) and Established Dedicated Helpline (855-291-2518).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Dedicated Helpline: 855-291-2518 (Mon-Fri, 8:00 A.M. - 8:00 P.M. Ct), Credit Monitoring And Identity Protection Services Offered and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Forensic Investigation Firm, .

Last Attacking Group: The attacking group in the last incident was an Unauthorized Party (Unknown).

Most Recent Incident Detected: The most recent incident detected was on 2025-08-25.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-10-02.

Most Significant Data Compromised: The most significant data compromised in an incident were Personally Identifiable Information (PII), Protected Health Information (PHI), Names, Dates of Birth, Phone Numbers, Social Security Numbers, Medical Information, Health Insurance Details and .

Most Significant System Affected: The most significant system affected in an incident was Vendor Email Accounts.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was forensic investigation firm, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Secured Affected Email Accounts.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Medical Information, Phone Numbers, Names, Social Security Numbers, Health Insurance Details, Protected Health Information (PHI), Dates of Birth and Personally Identifiable Information (PII).

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 2.0K.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Sign up for complimentary credit monitoring and identity protection, Review notices from Innovative Physical Therapy or its vendors, Be cautious of unsolicited emails/phone calls requesting personal information, Monitor financial accounts and credit reports for identity theft and Consider fraud alerts or credit freezes with major credit bureaus.

Most Recent Source: The most recent source of information about an incident are Innovative Physical Therapy Consumer Notice and U.S. Department of Health and Human Services (HHS) Breach Notification.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Third-Party Forensic Investigation Engaged).

Most Recent Customer Advisory: The most recent customer advisory issued were an Dedicated helpline: 855-291-2518 (Mon-Fri and 8:00 a.m. - 8:00 p.m. CT)Credit monitoring and identity protection services offered.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Phishing Emails (Vendor Employee Credentials).