River City Data Breach Investigation
SKR Group Inc dba River City Data reported a cybersecurity incident involving information maintained through its scanning and document-management services. The company’s notice states that an unauthorized actor obtained certain data, which may include Social Security numbers and health-related information for some individuals. Strauss Borrelli PLLC is investigating the incident and its potential impact on affected people. If you received a notice, you may fill out the secure contact form on this page to ask whether you may qualify to pursue a claim.
SKR Group Inc dba River City Data reported a cybersecurity incident involving information maintained through its scanning and document-management services. The company’s notice states that an unauthorized actor obtained certain data, which may include Social Security numbers and health-related information for some individuals. Strauss Borrelli PLLC is investigating the incident and its potential impact on affected people. If you received a notice, you may fill out the secure contact form on this page to ask whether you may qualify to pursue a claim.
Key Facts at a Glance
- Entity Involved: SKR Group Inc dba River City Data (Administrative Services)
- Incident Type: Hacking/IT incident involving reported unauthorized access
- Date of Incident: November 17, 2025, to January 15, 2026
- Discovery Date: February 2, 2026
- Official Notice Date: June 26, 2026
- Exposed Information: Potentially involved names, dates of birth, addresses, Social Security numbers, medical record numbers, health insurance information, and health information
- Affected Population: Not publicly stated in the available notice
What Happened?
According to the company’s cybersecurity notice, River City Data became aware on February 2, 2026, that an unauthorized actor had gained access to its environment. River City reported taking its systems offline, engaging external cybersecurity experts, and notifying law enforcement. The investigation reportedly determined that the actor obtained data stored on River City’s systems between November 17, 2025, and January 15, 2026. River City stated that it then informed its provider customer, which reviewed the involved files to identify the people connected to the information.
The notice says River City contained the incident, removed the unauthorized actor from its environment, and continued strengthening its systems and applications. It also reported beginning individual notifications on June 26, 2026. The available notice does not state how many people were affected, and the specific information involved may differ from person to person.
What Information Was Exposed?
River City Data’s notice says the information varied by individual and may have included:
- Names, dates of birth, and addresses
- Social Security numbers
- Medical record numbers
- Health insurance information
- Health information, including diagnoses, medications, test results, and treatment information
This combination of identity and medical data may create risks beyond ordinary financial fraud. Criminals could potentially use the information for medical identity theft, fraudulent patient billing, insurance-verification scams, prescription-related inquiries, or convincing messages that impersonate a healthcare provider or insurer. The notice does not establish that these forms of misuse occurred.
What Should You Do Next?
- Review your notice: Determine which information River City Data says was involved and follow the enrollment instructions for any complimentary services offered. The company reported offering credit monitoring and identity protection to individuals whose Social Security numbers were involved.
- Consider freezing your credit: A credit freeze through Equifax, Experian, and TransUnion can help prevent someone from opening a new account in your name. You may also place a fraud alert and review your credit reports for unfamiliar activity.
- Monitor medical and insurance records: Examine explanations of benefits, patient statements, prescription histories, and insurance communications for unknown providers, treatments, claims, or charges. Promptly dispute suspicious entries with the provider and insurer.
- Watch for targeted scams: Be cautious of calls, emails, or texts requesting insurance numbers, Social Security numbers, payment, or account credentials. Independently contact the healthcare provider or insurer using a verified telephone number.
- Document suspicious activity: Preserve the incident notice, credit reports, bills, correspondence, and records of time or expenses associated with responding. Report suspected identity theft through IdentityTheft.gov and contact relevant institutions promptly.
Your Legal Rights
People whose personal information was involved in the River City Data incident may have rights under applicable state privacy, consumer-protection, and data-breach notification laws. The availability of a claim and any potential remedies depend on factors such as where an individual lives, what information was involved, the harm or risk experienced, and the circumstances surrounding the incident.
Receiving a notification does not automatically establish a legal claim, and the absence of confirmed identity theft does not necessarily resolve every legal issue. A privacy attorney can review the notice and relevant facts, explain applicable deadlines, and assess whether compensation or other relief may be available. This information is general and is not individualized legal advice.
Why Hire Strauss Borrelli PLLC?
The firm represents consumers in privacy and cybersecurity matters and can evaluate whether the circumstances of this incident may support a legal claim. An attorney can review the information reportedly involved, assess applicable laws and deadlines, and explain potential options in clear terms. No outcome is guaranteed, but a confidential case review can help affected individuals make an informed decision about their next steps.
If you received a breach notification letter from River City Data:
We would like to speak with you about your rights and potential legal remedies in response to this data breach. Please fill out the form, below, or contact us at 872.263.1100 or sam@straussborrelli.com.
