Harbin Clinic Data Breach 2025: 176,149 Patients Exposed via Nationwide Recovery Services Vendor Hack. Class Action Filed. What To Do

Harbin Clinic, a multi-specialty physician group headquartered in Rome, Georgia with locations across northwest Georgia and roughly 1,400 staff, began mailing breach notification letters on May 16, 2025 to 176,149 patients whose information was compromised in a hack of its debt-collection vendor, Nationwide Recovery Services, Inc. (NRS). The intrusion happened almost a year earlier, between July 5 and July 11, 2024, and was confined to NRS’s network. Harbin Clinic’s own systems were not accessed.

Harbin’s filing landed on the HHS OCR breach portal as a Hacking/IT Incident at a Network Server with a business associate involved. A separate filing with the Maine Attorney General put the total at 210,140 individuals. Harbin’s HHS OCR figure of 176,149 is the federally reported count and the one used on this page; the difference reflects scope and reporting-criteria variation between the two filings, not a correction.

The NRS hack is a multi-entity vendor breach affecting a large number of healthcare providers. As of July 2025, at least 15 NRS clients had reported downstream breaches to federal and state regulators, collectively accounting for more than 516,000 affected individuals across Georgia, Tennessee, New Jersey, Illinois, and other states. Harbin Clinic is the single largest downstream entity by affected count in the cluster.

Timeline

• July 5, 2024. Unauthorized access to NRS’s network begins, per the forensic investigation.
• July 11, 2024. NRS identifies suspicious activity. Access ends the same day.
• February 2025. NRS completes its review and informs Harbin that some of the copied files contained data on patients and guarantors whose accounts had been sent to collections or were involved in other legal proceedings.
• March 2025. NRS provides Harbin with the list of 210,140 affected individuals and the categories of data involved.
• May 16, 2025. Harbin Clinic begins sending notification letters; the HHS OCR portal entry (176,149 individuals) is posted.
• May 20–22, 2025. Plaintiffs’ firms publicly announce investigations.
• June 26, 2025. At least eight class action complaints are removed to U.S. District Court for the Northern District of Georgia. Harbin Clinic simultaneously files a third-party complaint against NRS.
• August 4, 2025. Court grants Harbin’s motion to consolidate all eight related actions. Lead case: Staples v. Harbin Clinic, LLC, et al. (4:25-cv-00130), assigned to Judge William M. Ray II.
• August 7, 2025. Plaintiffs file a Motion to Appoint Interim Class Counsel (Shamis & Gentile as lead movant).
• November 25, 2025. Plaintiffs file a status report regarding mediation. Litigation remains pending.

What was exposed

Per Harbin Clinic’s notification and the secondary reporting:

• Full name
• Address
• Date of birth
• Social Security number
• Financial account information
• Guarantor information
• Medical-related information

Threat actor attribution is disputed. Cybernews reported that the Cl0p ransomware group claimed responsibility for the NRS intrusion and posted stolen data to its dark-web leak site after NRS did not engage. However, The Record from Recorded Future News reported that “no cybercriminal group ever took credit for the attack” and that a ransom payment may explain the silence. The HIPAA Guide reached the same conclusion. Both positions are single-source and neither can be confirmed on the public record. The data-posting claim from Cybernews is about NRS’s stolen data set generally, not a Harbin-specific leak-site listing.

What Harbin is offering

Harbin Clinic is offering affected individuals a complimentary 24-month membership to Kroll identity monitoring services. The Kroll offering includes:

• Single-bureau credit monitoring
• Fraud consultation
• Identity theft restoration

Harbin has also advised affected individuals to remain vigilant against identity theft and fraud for the next 12 to 24 months.

Affected individuals can reach the dedicated breach call center at (866) 408-3081, open Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern Time, excluding major U.S. holidays. Questions can also be directed to the website referenced in notification letters.

Class-action posture

At least eight individual class action complaints against Harbin Clinic were filed in Georgia state and federal courts and subsequently removed to the U.S. District Court for the Northern District of Georgia. On August 4, 2025, the court consolidated all eight cases under the lead docket Staples v. Harbin Clinic, LLC, et al., Case No. 4:25-cv-00130, before Judge William M. Ray II. The other consolidated cases are: Nash v. Harbin Clinic (4:25-cv-00137), Hudgins v. Harbin Clinic (4:25-cv-00174), Shutley v. Harbin Clinic (4:25-cv-00175), Dean v. Harbin Clinic (4:25-cv-00176), Stout v. Harbin Clinic (4:25-cv-00177), Ellenburg v. Harbin Clinic (4:25-cv-00178), and Rangel v. Harbin Clinic.

On August 7, 2025, plaintiffs filed a motion to appoint interim class counsel. Harbin Clinic also filed a third-party complaint against NRS in the consolidated action. A plaintiffs’ status report on mediation was filed November 25, 2025. The litigation remains pending.

Separately, NRS itself is named as a defendant in approximately a dozen proposed federal class action lawsuits filed by other downstream victims, per BankInfoSecurity reporting as of July 2025.

Plaintiffs’ firms that publicly announced investigations include:

• Shamis & Gentile (Andrew Shamis — lead movant for interim class counsel)
• Edelson Lechtzin LLP
• Federman & Sherwood
• Strauss Borrelli PLLC
• Lynch Carpenter LLP
• Morgan & Morgan (ForThePeople.com)

What to do

1. Enroll in the Kroll 24-month monitoring offered in your notification letter if you received one. The activation code is in the letter; the enrollment window is finite. For enrollment questions, call the dedicated breach hotline at (866) 408-3081, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern Time.
2. Place free credit freezes at Equifax, Experian, and TransUnion. Kroll’s offering is single-bureau monitoring, which is not a substitute for freezes at all three.
3. Pull free credit reports at annualcreditreport.com and watch for unfamiliar accounts, especially given that Social Security numbers and financial account information are in scope.
4. Watch for collections-related phishing. Because the exposed data set came from a debt-collection vendor and includes guarantor information, expect targeted scam calls and emails that reference real account details — callers may cite real balances or account numbers to seem credible.
5. If Social Security numbers are involved, file IRS Form 14039 (Identity Theft Affidavit) with the IRS to flag your SSN and reduce the risk of fraudulent tax filings.
6. Did not receive a letter but suspect you should have? Contact Harbin Clinic at the hotline above or write to its privacy officer. The Maine AG filing lists 210,140 individuals; the HHS OCR count is 176,149 — if your account was in collections or related legal proceedings at Harbin, you are likely in scope.
7. Stop the ongoing flow of your medical and financial data to debt-collection vendors. HealthConsent files HIPAA restriction requests targeting the revenue-cycle and debt-collection pathways at your providers. That is the exact pathway that exposed your information in this breach — preventing your records from flowing to the next NRS-type vendor starts with a filed restriction request.

Sources

• HHS Office for Civil Rights Breach Portal — primary federal record (176,149).
• HIPAA Journal — Harbin Clinic / Nationwide Recovery Services data breach — timeline, data elements, Kroll offering.
• SecurityWeek — 200,000 Harbin Clinic Patients Impacted by NRS Data Breach — affected counts.
• Infosecurity Magazine — Debt Collector Data Breach — vendor context, Maine AG count (210,140).
• Cybernews — 210k patients hit after Georgia clinic’s vendor hack — Cl0p attribution claim and dark-web posting.
• The Record (Recorded Future News) — NRS breach exposes medical info of 500,000+ people — disputes attribution; “no cybercriminal group ever took credit”; cluster scope.
• HIPAA Guide — Victim Count of NRS Data Breach Grows to 516,000 — downstream entity cluster table, ransom-payment hypothesis.
• BankInfoSecurity — Nationwide Recovery Service Hack Grows to 500,000 Victims — approximately one dozen proposed class actions against NRS; vendor risk analysis.
• Northwest Georgia News (Rome) — Harbin Clinic Offering Protections After Vendor Data Breach — local coverage.
• ClassAction.org — Harbin Clinic Data Breach Lawsuit Investigation — plaintiffs’ firm activity.
• PacerMonitor — Staples v. Harbin Clinic LLC (4:25-cv-00130) — consolidation order, class counsel motion, mediation status.
• Harbin Clinic notification letter (via ClassAction.org) — Kroll activation, call center number (866) 408-3081.
• Lynch Carpenter announcement (GlobeNewswire) — investigation announcement.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2025 healthcare data breaches