Harbin Clinic, LLC

Harbin Clinic, LLC notified the New Hampshire Attorney General that a third-party vendor, Nationwide Recovery Services, Inc. (NRS), experienced a data security incident. Unauthorized access to NRS systems occurred between July 5-11, 2024, resulting in the illegal copying of files. The incident potentially affected 12 New Hampshire residents (patients and guarantors) whose personal information was stored on NRS systems. Harbin Clinic blocked vendor access, conducted internal system reviews, and engaged privacy teams. Notifications were sent on May 16, 2025, offering Kroll identity monitoring services.

Harbin Clinic LLC notified Nebraska AG that third-party vendor Nationwide Recovery Services (NRS) experienced unauthorized access to its network between July 5-11, 2024. Patient data (names, SSNs, DOB, financial, medical info) was copied. Harbin blocked NRS access, conducted internal reviews, and engaged privacy/cyber teams. NRS notified law enforcement and implemented new security measures. Harbin offered 24 months of Kroll identity monitoring to affected patients.

Harbin Clinic, LLC reported to HHS on 2025-05-16 a Hacking/IT Incident affecting 176149 individuals. Breached information located on Network Server. Business associate was present.

Harbin Clinic LLC reported a data breach to the Indiana Attorney General. The breach occurred on 2024-07-05 and was reported on 2025-05-16. 109 Indiana residents were affected. 210,140 individuals affected in total.

Harbin Clinic, LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2025-05-16. 27 Massachusetts residents were affected.

HARBIN CLINIC, LLC filed a data-breach notice with the Illinois Attorney General in May 2025 (case 25-05-156). The register records the breach as discovered on March 20, 2025. Personal information types reported: financial account number, medical information, ssn. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.