Federal lawsuit filed in response to debt collection agency’s data breach

CHATTANOOGA, Tenn. (WDEF)- A few weeks ago, a data breach began being uncovered across multiple agencies in our area.

Now, that debt collection company is at the center of a federal lawsuit.

Hamilton County and the city of Chattanooga recently announced that they were affected by a data breach involving Nationwide Recovery Services.

They are a debt collection agency that have been contracted by numerous agencies.

However, a new federal lawsuit says they, along with a Dalton hospital, were too slow to act.

NRS is being sued alongside Hamilton Health in Dalton by a Whitfield County resident, Felica Cooper.

Hamilton Health is owned by Vitruvian Health, who have also acquired the Bradley Medical Center in Cleveland alongside numerous North Georgia medical clinics.

Cooper says in the lawsuit that she did not receive a notice of the breach until April 14.

NRS says the breach occurred nine months ago in July, meaning over nine months passed from the breach to the notification to potential victims.

Data included in the breach ranges from health information to Social Security numbers.

A copy of the letter sent to Cooper says that Vitruvian Health was not notified of the breach until February 24 this year.

The city of Chattanooga and Hamilton County government experienced a similar delay, with the city not receiving a letter until February 7, and the county on March 5.

In both of those cases, neither mayor was notified until several weeks after the initial letter was sent.

In cases of data breaches of personal and health information, agencies only have 60 days to notify potential victims.

Two weeks ago, the Chattanooga City Council renewed the contract with NRS to continue data collection services.

On Tuesday, that tone had shifted.

Director of Purchasing for the city, Debbie Talley told the Council, “This is for finance. We are requesting rescinding the final renewal that was approved on April 8, 2025 for debt collection services to Nationwide Recovery Services.”

The Council voted to unanimously overturn that decision.

We reached out to Vitruvian Health and did not hear back on Wednesday, but they have placed an informational page for potential victims on their website.

Among other demands, the plaintiff in this case is asking for NRS to pay a minimum of 10 years of credit monitoring services.