David A. Nover, M.D., P.C. Data Breach 2025: 4,703 Affected · Hacking/IT Incident · PA. Filed With HHS OCR. What To Do.

David A. Nover, M.D., P.C., a solo psychiatry and psychotherapy practice in Warrington, Pennsylvania, filed a HIPAA breach notification with the U.S. Department of Health and Human Services Office for Civil Rights on July 31, 2025, reporting 4,703 affected individuals in a Hacking/IT Incident at a Network Server. Substitute notices were subsequently filed with the Vermont, Massachusetts, and New Hampshire Attorney General offices in early November 2025, and individual letters began arriving with affected patients in the same window.

According to the practice’s own consumer notice, unusual activity was detected within the internal network on June 3, 2025. A forensic investigation, conducted with outside legal counsel and digital forensics specialists, confirmed that an unauthorized actor accessed the network on that date and copied some files containing patient information. The review of those files concluded on October 29, 2025, at which point individual notifications could be prepared.

Timeline

• June 3, 2025 — Practice identifies unusual activity on its internal network. Investigation later confirms unauthorized access and data exfiltration on this date.
• July 31, 2025 — Breach reported to HHS OCR as a Hacking/IT Incident at a Network Server affecting 4,703 individuals.
• October 29, 2025 — Third-party forensic review of impacted files completed.
• November 3, 2025 — Notices filed with the Massachusetts and New Hampshire Attorney General offices; mailing of individual notification letters begins.
• November 4, 2025 — Notice filed with the Vermont Attorney General; Strauss Borrelli PLLC announces a class-action investigation.

Data exposed

The practice’s substitute notice, as filed with the Vermont Attorney General, lists the following categories of information as potentially viewed or copied. Not every category applies to every affected individual; the specific elements involved are described in each person’s individual letter.

• Name
• Date of birth
• Social Security number
• Payment card information, including card number, expiration date, and security or access information
• Medical record number, patient ID, or account number
• Medicare number
• Health insurance ID number and group number
• Medical diagnosis and treatment information
• Treatment location, treating provider name, and treatment dates
• Medical lab or test results

The combination of Social Security number, payment card data, and clinical detail in a single exfiltration is unusually broad for a solo practice and warrants taking the protective steps below seriously.

What the practice is offering

Affected individuals are being offered 12 months of complimentary single-bureau credit monitoring and identity protection services through TransUnion Cyberscout, plus access to a dedicated assistance line (1-833-594-0856) referenced in the consumer notice. Enrollment instructions and a personal activation code are included with each individual notification letter.

Class-action investigation

On November 4, 2025, the law firm Strauss Borrelli PLLC publicly announced an investigation on behalf of individuals whose information was exposed in this incident. As of this page’s last update, no class-action complaint has been docketed and no settlement has been announced. Plaintiffs’ firms typically file within weeks of substitute notice for incidents of this size where Social Security numbers and clinical records are confirmed exposed.

What to do if you may be affected

• Read the letter carefully. Your individual notification will list the specific data elements involved for you, which is the basis for any later claim if a class action is filed and settles.
• Enroll in the offered credit monitoring. The activation code in the letter is yours specifically and expires; enrollment costs nothing and does not waive any legal rights.
• Freeze your credit with Equifax, Experian, and TransUnion. It is free, takes about ten minutes per bureau, and is the single highest-leverage step against new-account identity theft. A freeze is more protective than monitoring alone.
• Watch payment card statements. Because payment card data including security/access information was implicated, request a new card number from your issuer rather than relying on transaction monitoring alone.
• Be cautious of follow-on phishing. Threat actors with clinical detail can craft convincing impersonations of providers, insurers, or Medicare. Verify any unexpected contact by calling the entity at a number you look up independently.
• Keep the letter. If a class action settles, the letter is your proof of standing as a class member.

Sources on this page

• HHS Office for Civil Rights Breach Portal — the federal regulatory record of this breach.
• Vermont Attorney General — David A. Nover, M.D., P.C. Data Breach Notice to Consumers (Nov. 3, 2025) — the practice’s substitute consumer notice with full data-element list and credit-monitoring offer.
• Massachusetts Attorney General — Data Breach Notification Letters, November 2025 — confirms parallel state filing in November 2025.
• Strauss Borrelli PLLC — David A. Nover, M.D., P.C. Data Breach Investigation — class-action investigation announcement.
• ClaimDepot — Dr. David A. Nover Data Breach Summary — independent summary of dates, data exposed, and the TransUnion Cyberscout offering.
• HIPAA Journal — Largest Healthcare Data Breaches of 2025 — established trade-press tracker covering OCR-reportable healthcare incidents.