Fyzical Data Breach Affects 43,045 People, Exposing SSNs and Medical Info

Fyzical Acquisition Holdings, LLC, the parent company of FYZICAL Therapy & Balance Centers, recently reported a significant data breach compromising personally identifiable information (PII) and protected health information (PHI) of 43,045 people, including 1,801 residents of Texas and six in New Hampshire.

On or about Dec. 9, 2024, Fyzical Acquisition Holdings became aware of unusual activity within its email environment. This prompted an immediate investigation, which revealed that unauthorized access to certain email data had occurred. The investigation determined that some email data may have been viewed or copied by an unauthorized party.

A comprehensive review followed to determine what sensitive information was impacted and to identify the individuals affected. This review concluded on Nov. 25, 2025. The breach resulted in the exposure of a range of highly sensitive information, which varied by individual.

The types of information exposed included names, dates of birth, Social Security numbers, driver’s license or state ID numbers, financial account information, credit card information, patient ID or account numbers, medical record numbers and health insurance information, including account and group numbers. Medical health information was also exposed, including treatment details, locations and dates.

Fyzical reported the breach to the U.S. Department of Health and Human Services on March 21, 2025. It later reported it to the New Hampshire Attorney General on Dec. 19, 2025 and the Texas Attorney General on Dec. 22, 2025.

Fyzical also posted a Notice of Data Privacy Event on its website.

Fyzical data breach lawsuit

Several patients have sued Fyzical over the breach. The first case, Herrera v. Fyzical Acquisition Holdings, LLC, was filed on Dec. 30, 2025 in federal court in Tampa, Florida, and two later cases were combined with it on Jan. 29, 2026.

On June 29, 2026, the judge let the patients’ negligence and breach of implied contract claims move forward. The judge dismissed some other claims but allowed the patients to refile them.

Fyzical Acquisition Holdings' response

After discovering the breach, Fyzical Acquisition Holdings initiated a comprehensive review of the compromised data to identify all affected individuals. Fyzical mailed letters to affected people starting Dec. 19, 2025. It is offering at least 12 months of free credit monitoring and identity protection through IDX.

If you receive notification from Fyzical Acquisition Holdings or your provider about this breach, you may want to:

• Sign up for the free IDX identity theft protection services, offered by Fyzical Acquisition Holdings.
• Monitor your credit reports and financial accounts for any unusual activity.
• Be alert for phishing emails or phone calls that may use your exposed information.
• Consider placing a fraud alert or credit freeze with major credit bureaus.