Healthcare Therapy Services
Disclosed Nov 7, 202510 months ago16,857 affectedConfirmed
Health Therapy Services, the covered entity CE), reported that an employee was the target of an email phishing scheme that affected the protected health information (PHI) of 15,027 individuals. The PHI included clinical, financial and demographic information. The CE notified HHS, the affected individuals, the media and posted substitute notice on its website. In its mitigation efforts, the CE implemented additional technical, administrative and security safeguards, updated its HIPAA policies and procedures, and retrained staff.
What is known
| People affected | 16,857 (as reported by the organization) |
|---|---|
| Disclosed | Nov 7, 2025 |
| Happened | Apr 22, 2025 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2025 data breach report: Healthcare Therapy Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Healthcare Therapy Services (Healthcare Provider, IN)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Nov 7, 2025 | 2,676 |
| HHS archivetotal | Nov 8, 2025 | 15,027 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · summary: empty to Health Therapy Services, the covered entity CE), reported that an employee was the target of an email phishing scheme that affected the protected health information (PHI) of 15,027 individuals. The PHI included clinical, financial and demog · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.