Horizon Healthcare RCM Breach (IN, 2024-2025): 210,901 Affected by December Ransomware at Indiana Revenue-Cycle Vendor

Horizon Healthcare RCM (legal name: Horizon Financial Management, LLC), a revenue cycle management vendor headquartered at 9980 Georgia Street, Crown Point, Indiana, was hit by a ransomware attack on December 27, 2024 that locked files and exfiltrated patient data belonging to its downstream provider clients. The company filed its HIPAA breach notification with HHS on June 27, 2025, and by late November 2025 the confirmed affected population had grown to 210,901 individuals. Horizon publicly indicated it paid the threat actors to delete the stolen data, and no ransomware group has claimed responsibility on a public leak site.

Because Horizon is a business associate, the patients receiving these letters are customers of the hospitals, physician groups, and health systems that hired Horizon to handle billing and claims — not direct customers of Horizon itself.

What happened

An unauthorized actor first accessed Horizon’s network on December 25, 2024. Two days later, on December 27, ransomware encrypted files on certain systems. Horizon identified the intrusion the same day and launched an investigation with external cybersecurity experts. The forensic review determined that files had been “likely copied without permission” between December 26 and 27, 2024.

Horizon completed its internal review of all affected files on May 20, 2025. On June 27, 2025, it filed its HIPAA breach report with HHS OCR (initial count: 77,410) and began mailing notification letters. Simultaneously, it filed with the Attorneys General of Maine, Massachusetts, New Hampshire, and South Carolina. By November 26, 2025, when Vermont published its consumer notice, the total affected count had grown to 210,901.

Horizon’s notice states it “arranged for the party responsible for this matter to delete the copied information” — widely interpreted as a ransom payment, though Horizon did not confirm payment directly. No ransomware group has publicly claimed the attack on any leak site. One secondary source (Digital Watch Observatory) reported a suspected LockBit affiliation, but this has not been corroborated by threat intelligence services or Horizon’s own disclosures and should be treated as unconfirmed.

What was stolen

The data elements vary by individual. For the broad majority, the exposed information was limited to internal Horizon identifiers, customer or patient numbers, and general health insurance claims processing information. For a smaller subset, the breach involved more sensitive elements:

• Names
• Dates of birth
• Social Security numbers
• Driver’s license numbers and passport numbers
• Medical record numbers
• Payment card information
• Checking or other financial account information
• Non-address contact information (email addresses, phone numbers)

Horizon’s own notice stated that “fewer than 500 people” had the more sensitive elements (SSNs, financial account data, government IDs) exposed. The confirmed data categories above are drawn from Horizon’s own notification letter and the Maine Attorney General filing.

Who’s notifying you (and why it’s not your hospital)

Horizon Healthcare RCM is a HIPAA business associate — a vendor that hospitals and physician groups hire to run their revenue cycle (billing, coding, claims). Public materials and Horizon’s own client list have referenced healthcare organizations such as Ascension Health, Bon Secours Health System, Franciscan Alliance, Guthrie Lourdes Hospital, Methodist Hospitals, Adfinitas Health, Ensemble Health Partners, and others as customers of its services.

If you received a Horizon Healthcare RCM letter, the data originated from a provider you saw — not from a company you signed up with directly. The notification letter is being mailed by Horizon under its own letterhead because, as the business associate that suffered the intrusion, it is the entity required to notify under HIPAA. In some cases, Horizon could not identify the covered-entity customer whose data was involved, so some letters were sent without naming the provider.

What Horizon is offering

Horizon is offering 12 months of complimentary identity monitoring through Kroll, a global risk mitigation firm. The monitoring package includes credit monitoring, fraud consultation, and identity theft restoration.

To activate:

• Visit enroll.krollmonitoring.com and use the membership number printed on your notification letter.
• The activation deadline is stated in your specific letter; the template uses a per-recipient deadline date.

For questions, call Horizon’s dedicated assistance line: 1-866-461-8271, Monday through Friday, 9:00 a.m. to 6:30 p.m. Eastern (excluding U.S. holidays). You may also write to: Horizon Healthcare RCM, Attn: Compliance, 9980 Georgia St, Crown Point, IN 46307.

State AG filings

Horizon notified multiple state regulators. Confirmed filings and resident counts reported:

• Maine: 11 residents affected (filed June 27, 2025)
• Massachusetts: 43 residents affected (filed June 27, 2025)
• New Hampshire: 14 residents affected (filed June 27, 2025)
• South Carolina: 5,499 residents affected (filed June 27, 2025; notice posted by SC Consumer Affairs)
• Vermont: consumer notice published November 26, 2025; revised total count of 210,901 disclosed in this filing

Class-action posture

At least eight plaintiff firms have publicly announced investigations or filed complaints connected to the Horizon Healthcare RCM breach. Cohen & Malad, LLP (Indianapolis) is among the most active given Horizon’s Indiana headquarters; Strauss Borrelli PLLC, Federman & Sherwood, Wolf Haldenstein Adler Freeman & Herz LLP, Levi & Korsinsky LLP, Murphy Law Firm, Srourian Law Firm, and Maxey Law Firm have also issued investigation notices.

The expected venue for consolidated litigation is the U.S. District Court for the Northern District of Indiana, where Horizon is based. No docket number for a filed complaint has been publicly confirmed as of this page’s last update.

What to do

1. Enroll in Kroll identity monitoring using the membership number in your notification letter. Visit enroll.krollmonitoring.com. The enrollment deadline is printed on your specific letter — do not miss it.
2. Freeze your credit at Equifax (1-888-298-0045), Experian (1-888-397-3742), and TransUnion (1-833-799-5355). It is free, reversible, and the single most effective step against new-account fraud.
3. File IRS Form 14039 if your Social Security number was exposed, to flag your tax account against fraudulent returns. SSN exposure in healthcare billing breaches frequently surfaces as fraudulent tax filings in the year following the breach.
4. Cancel or reissue payment cards if your notification letter indicates checking account or payment card information was involved. Contact your bank directly; do not rely on monitoring alone for financial accounts.
5. Watch insurance EOBs and Medicare Summary Notices for services you did not receive. Revenue cycle data is particularly useful to fraudsters seeking to file false insurance claims.
6. Keep the notification letter. If a class settlement is reached, you will need the breach reference number and possibly proof you received a letter to submit a claim. Do not pay any fee to participate — legitimate class-action processes are free to class members.
7. Stop the ongoing flow of your billing and claims data. HealthConsent files HIPAA restriction requests so the health insurance and treatment information exposed in this breach is not continuously re-shared across revenue cycle networks and clearinghouses.

Continue reading

• Your HIPAA rights explained
• All tracked healthcare breaches

Sources

• HIPAA Journal — Horizon Healthcare RCM Announces December 2024 Ransomware Attack
• Vermont Attorney General — Horizon Healthcare RCM Data Breach Notice to Consumers (Nov. 26, 2025)
• DataBreaches.net — Horizon Healthcare RCM discloses ransomware attack in December
• BankInfoSecurity — Another Billing Software Vendor Hacked by Ransomware
• Comparitech — Medical billing company Horizon Healthcare notifies 77K people of data breach
• ClassAction.org — Horizon Healthcare RCM Data Breach Notification Letter (PDF)
• Cohen & Malad, LLP — Horizon Healthcare RCM Data Breach Lawsuit
• Federman & Sherwood — Horizon Healthcare RCM Data Breach Investigation
• ClaimDepot — Horizon Healthcare RCM Data Breach Affects 210,901 People
• South Carolina Consumer Affairs — Horizon Healthcare RCM Notification Letter (PDF)
• Paubox — Horizon Healthcare RCM confirms December ransomware attack
• HHS Office for Civil Rights Breach Portal