Strauss Borrelli PLLC, a leading data breach law firm, is investigating Health Care and Rehabilitation Services of Southeastern Vermont, Inc. (“HCRS”), regarding its recent data breach. The HCRS data breach may have involved sensitive personal identifiable information and protected health information belonging to an unknown number of individuals.
ABOUT HEALTH CARE AND REHABILITATION SERVICES OF SOUTHEASTERN VERMONT, INC.:
HCRS is a community mental health and developmental services agency based in Vermont. Founded in 1967, HCRS serves over 4,000 individuals annually through its key programs for mental health, substance abuse, and developmental disabilities.2,3 Headquartered in Springfield, Vermont, HCRS also has additional locations in Bellows Falls, Brattleboro, White River Junction, Hartford, Newfane, Townshend, Springfield, Windsor, Proctorville, and Woodstock, Vermont.2,4
WHAT HAPPENED?
On Jun 9, 2025, HCRS announced that it had experienced a data breach in which the sensitive personal identifiable information and protected health information in its care may have been compromised.1 According to the breach notice posted on its website, on December 20, 2024, HCRS identified unauthorized access to two email accounts in its email environment.1 As a result, HCRS launched an investigation to determine the nature of the incident.
Through its investigation, HCRS discovered on May 13, 2025, that certain email accounts within the HCRS email environment were accessed by an unauthorized actor between approximately December 4, to on or about December 9, 2024.1 Additionally, HCRS’s investigation determined the emails and files accessed by the unauthorized party contained certain personal information for clients and staff. As a result, HCRS began a review of the data to determine what information had been impacted as well as identify the specific individuals affected. According to the breach notice, the sensitive personal information potentially affected includes the following types of information:
- Name
- Social Security number
- Date of birth
- Driver’s license number
- Financial account information
- Health records
Recently, HCRS began providing notice to impacted individuals. Based on the notice sent to Vermont residents, HCRS is providing affected individuals with a list of the specific types of sensitive information impacted. A link to the breach report filed by the Attorney General of Vermont is below.
If you received a breach notification letter from Health Care and Rehabilitation Services of Southeastern Vermont, Inc.:
We would like to speak with you about your rights and potential legal remedies in response to this data breach. Please fill out the form, below, or contact us at 872.263.1100 or sam@straussborrelli.com.
