Cyber attack on U.S. drug rehab service exposes sensitive patient information

Texas-based Nova Recovery Centre said it suffered a significant cyber security incident earlier this year that compromised the personal and financial information of nearly 10,000 individuals.

 

Headquartered in Wimberley, Texas, Nova Recovery LLC doing business as Nova Recovery Centre offers comprehensive, evidence-based alcohol and drug rehab with gender-specific programs.

 

In a data security incident notice filed with the Office of Maine Attorney General, Nova Recovery said that on  May 25, it identified suspicious activity within its internal network. The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“After a thorough investigation, on June 17, 2025, Nova Recovery learned that certain Nova Recovery business records stored in Nova Recovery’s network, including some records that contained personal information were subject to unauthorized access. On July 9, 2025, Nova Recovery identified the individuals whose personal information was involved in the event,” Nova Recovery said.

 

The compromised data included full names, addresses, dates of birth, Social Security numbers, and documentation with financial payment information in relation to services provided by Nova Recovery. The filing with the Maine state regulator also states that the healthcare provider has identified at least 7,713 individuals impacted by the incident.

 

“Upon discovering the incident, and to mitigate any potential harm, Nova Recovery immediately took action to contain the incident and to secure and restore the involved systems. 

 

“We notified federal and local law enforcement authorities, and we are notifying state and federal agencies, as required by HIPAA and state privacy laws,” Nova Recovery added.

 

The healthcare provider has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general. 

 

It has also offered two years of complimentary identity protection and credit monitoring services through Kroll to all affected individuals.