Thrive Physical Therapy Partners
Disclosed Apr 14, 20251 year ago986 affectedConfirmed
Thrive Physical Therapy Partners, the business associate (BA) reported that an employee was the target of an email phishing scheme that compromised the protected health information (PHI) of 986 individuals. The PHI involved included demographic, clinical, and financial information. The BA notified HHS, impacted individuals, and the media. In its mitigation efforts, the BA implemented additional administrative, technical, and security safeguards to better protect sensitive data. OCR provided technical assistance regarding the HIPAA Rules.
What is known
| People affected | 986 (as reported to HHS) |
|---|---|
| Disclosed | Apr 14, 2025 |
| Happened | Dec 19, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Indiana Attorney General 2025 data breach report: Thrive Physical Therapy Partnersin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Thrive Physical Therapy Partners (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | Apr 14, 2025 | 1 |
| HHS archivetotal | Apr 16, 2025 | 986 |
| Indiana AGresidents of IN | Oct 3, 2025 | 42 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 628 to 986 · backfill source
- 2026-09-25 · summary: empty to Thrive Physical Therapy Partners, the business associate (BA) reported that an employee was the target of an email phishing scheme that compromised the protected health information (PHI) of 986 individuals. The PHI involved included demogra · backfill source
- 2026-09-25 · records: 22 to 628 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Indiana AG), confirmed by Indiana AG. Record counts are as reported. Not legal advice.