River City Data Breach Exposes Financial and Health Information

River City Data, a document management company based in New London, Minnesota, disclosed a data breach that affected 1,718 individuals in the United States.

River City Data discovered the breach on Feb. 2, 2026. Upon discovering the unauthorized access, River City Data took all of its systems offline and brought in outside cybersecurity experts to investigate the incident and to remediate its computer environment.

The investigation determined that between Nov. 17, 2025, and Jan. 15, 2026, an unauthorized actor had gained access to River City Data's computer environment and obtained certain data stored on its systems.

Because River City Data operates as a third-party service provider, individuals affected by this breach may not have had a direct relationship with the company. Their personal and medical information was likely stored on River City Data's systems because a healthcare provider, government agency or another organization hired the company to scan, digitize or manage records on its behalf.

The personally identifiable information, or PII, that may have been exposed includes patient names, dates of birth, addresses, Social Security numbers and financial information.

Protected health information, or PHI, may also have been compromised, including medical record numbers, diagnoses, medications, test results, treatment details and health insurance information.

The breach was disclosed to the U.S. Department of Health and Human Services on June 26, 2026. River City Data posted a notice of the cybersecurity incident on its website on June 26, 2026.

The company began sending notification letters to affected individuals on June 26, 2026, approximately four months after it first discovered the breach.

River City Data's response to the breach

The company recommended that affected individuals review relevant financial and medical statements for any unrecognized activity or transactions.

River City Data has also established a dedicated toll-free call center for individuals who have questions about this incident or need additional information. The call center can be reached at 844-945-7193 and is available from 8 a.m. to 5:30 p.m. Central Time, Monday through Friday, excluding major U.S. holidays.