Hamilton County and the City of Chattanooga have announced separate but related data breaches stemming from a cybersecurity incident at Nationwide Recovery Services, a collection agency based in Cleveland, Tennessee.
The breach has potentially compromised the personal and financial information of thousands of individuals, including patients of Hamilton County Emergency Medical Services (EMS) and those whose debt collection data was handled by the city.
Hamilton County officials disclosed last Thursday that they were notified of a breach of protected health information (PHI) after receiving an email from Nationwide Recovery Services on July 14, 2024. The email contained a letter confirming a cybersecurity event that had been reported to federal law enforcement. Subsequent investigations revealed that unauthorized access to Nationwide Recovery Services’ network occurred between July 5 and July 11, 2024, resulting in the copying of sensitive files and folders.
The compromised data potentially includes names, addresses, Social Security numbers, dates of birth, financial account information, and medical-related information belonging to Hamilton County EMS patients. According to the county’s notification, 14,084 individuals’ PHI was affected. Letters will be sent to these individuals once the investigation is complete and mailing addresses are verified.
“Hamilton County sincerely regrets that this has happened, and apologizes for any inconvenience this breach may have caused our citizens,” the county’s notification stated. “Hamilton County government is committed to providing quality patient care, including protecting your personal information.”
Meanwhile, the City of Chattanooga also learned of its involvement in the breach through a letter dated February 7, 2025, from Nationwide Recovery Services. The agency, which provides debt collection services to the city, had initially sent an email notification on July 14, 2024. City officials are now investigating why this initial notification failed to reach the appropriate channels.
“The failure of this information to reach necessary channels is an unacceptable error,” Chattanooga Mayor Tim Kelly’s office said in a statement. “We will launch a thorough investigation into how this information failed for so long to reach necessary channels, and we will share the results of that investigation with the public, while taking the necessary steps to ensure this kind of error never happens again.”
City spokesperson Eric Holl emphasized that there is no indication that any data beyond debt collection services was affected. The City Attorney’s office has written to Nationwide Recovery Services, demanding that they notify all potentially affected individuals and offer complimentary credit monitoring and identity protection.
Both the city and county are urging affected individuals to monitor their credit and medical records closely. Hamilton County has established a dedicated contact for inquiries: individuals can contact the county’s privacy officer, Angela Duncan, by phone at 833-484-8671 or by email at HIPAA@HamiltonTN.gov, using the subject line “HIPAA Breach.”