Complete Care Rehab LLC Data Breach 2025: 4,764 Affected · Hacking/IT Incident · MI. Filed With HHS OCR. What To Do.

Complete Care Rehab LLC, a physical therapy practice based in Eastpointe, Michigan, disclosed a network intrusion that exposed protected health information for 4,764 current and former patients. The practice identified suspicious activity within its IT environment on or around May 11, 2025, posted a Notice of Data Privacy Event to its website on July 2, 2025, and filed the breach with the U.S. Department of Health and Human Services Office for Civil Rights on July 8, 2025. The OCR portal classifies the event as a Hacking/IT Incident at a Network Server.

Third-party cybersecurity experts engaged by the practice confirmed that an unauthorized actor accessed the network and that patient information was viewed or acquired. The substitute notice does not state whether ransomware was deployed, but HIPAA Journal reported that the practice attempted to restore data from backups and the restoration process failed, with patient information lost.

Timeline

• May 11, 2025. Suspicious activity identified in the Complete Care Rehab IT environment. Third-party cybersecurity experts engaged.
• July 2, 2025. Notice of Data Privacy Event posted on the Complete Care Rehab website.
• July 8, 2025. Breach reported to HHS OCR, listing 4,764 affected individuals.
• July 15, 2025. Strauss Borrelli PLLC announces an investigation on behalf of affected patients. Other class-action firms follow.

Exposed data

Per the substitute notice and forensic findings reported in HIPAA Journal, the categories of information involved include:

• Names
• Phone numbers
• Mailing and email addresses
• Dates of birth
• Diagnoses
• Treatment information and dates of service
• Health insurance information
• Social Security numbers (for a limited number of patients)

What is being offered

The publicly available substitute notice and contemporaneous reporting do not specify the credit-monitoring or identity-protection package being offered, the enrollment deadline, or the activation code mechanism. The notification letter mailed to affected individuals is the authoritative source for those terms. If you received a letter, follow the enrollment instructions printed on it before the deadline.

Class action activity

At least three plaintiffs’ firms have opened public investigations of Complete Care Rehab in connection with this incident:

• Strauss Borrelli PLLC (investigation announced July 15, 2025)
• Shamis & Gentile P.A.
• Siri & Glimstad LLP

No consolidated complaint, settlement, or court docket has been publicly reported on this page as of the last update. Class-action investigations are not the same as filed lawsuits and do not guarantee that litigation, certification, or a settlement will follow.

What to do if you may be affected

• Watch the mail. Notification letters typically follow the OCR filing by several weeks. The letter will list the specific data elements involved in your record and any complimentary credit-monitoring offered.
• If your Social Security number was involved, place a free credit freeze with each of the three nationwide consumer reporting agencies (Equifax, Experian, TransUnion). A freeze is the single highest-leverage protection against new-account identity theft and is free under federal law.
• Enroll in any complimentary monitoring offered in your letter before the deadline. Even if you do not believe your SSN was involved, enrollment costs you nothing.
• Be alert to phishing. Threat actors often follow up breach disclosures with targeted phishing emails and phone calls that reference the breach. Complete Care Rehab will not ask for your SSN, payment, or password by email or phone.
• Keep your records. Save the notification letter, any enrollment confirmations, and a log of time spent dealing with the breach. These are routinely requested if a class settlement is later announced.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• HIPAA Journal — Small Michigan Physical Therapy Practice Reports Loss of Patient Data Due to Cyberattack — trade-press reporting confirming dates, affected count, data categories, and backup-restoration failure.
• Strauss Borrelli PLLC — Complete Care Data Breach Investigation — class-action investigation announcement (July 15, 2025).
• Siri & Glimstad LLP — Investigation of Complete Care Rehab LLC Data Breach — additional class-action investigation.
• ClaimDepot — Complete Care Rehab Data Breach Lawsuit Investigation — aggregator summary of the disclosure timeline and exposed data categories.