FYZICAL ACQUISITION HOLDINGS, LLC Data Security Incident

FYZICAL ACQUISITION HOLDINGS, LLC was the subject of a data breach notification filed with the IL Attorney General. The AG filing was recorded on November 25, 2025.

FYZICAL Acquisition Holdings, LLC operates within the specialized healthcare and physical therapy sector, serving as a corporate parent and management entity for a nationwide network of physical therapy clinics and rehabilitation centers. In the course of delivering comprehensive orthopedic, neurological, and vestibular rehabilitation services, the enterprise and its affiliated clinics amass a vast repository of highly sensitive patient information. This data ecosystem encompasses detailed medical intake histories, physician referrals, diagnostic evaluations, insurance claim files, and core demographic identifiers. Because physical therapy practices require continuous patient monitoring, extensive documentation of physical limitations, and direct interaction with commercial health insurance payers and government healthcare programs, FYZICAL Acquisition Holdings and its network entities are entrusted with deeply personal health information that demands the highest standard of data security. In 2025, FYZICAL Acquisition Holdings, LLC reported a significant data security incident to the Illinois Attorney General, triggering legal scrutiny regarding the adequacy of its digital safeguards. While breach notifications of this nature frequently stem from unauthorized network intrusions, sophisticated ransomware deployments, or vulnerabilities within third-party vendor platforms used for practice management and billing, incidents involving healthcare-adjacent holding companies often expose centralized administrative databases. These networks frequently house administrative records, patient intake portals, and employee credentials, making them lucrative targets for malicious actors seeking to extract valuable protected health information and personally identifiable information. The exposure resulting from the 2025 incident compromises multiple categories of sensitive data, each carrying severe and distinct risks for affected individuals. The compromise of full names, dates of birth, and Social Security numbers creates an immediate, long-term threat of identity theft and synthetic fraud, where malicious actors can open fraudulent credit lines or secure unauthorized loans. Furthermore, the potential exposure of medical record numbers, health insurance identification numbers, and detailed treatment histories leaves patients uniquely vulnerable to medical identity theft. This insidious form of fraud can result in compromised medical histories, fraudulent insurance claims billed under a victim's name, and interference with legitimate healthcare delivery and insurance coverage. As an entity handling protected health information and sensitive consumer records, FYZICAL Acquisition Holdings, LLC is bound by rigorous statutory and common law duties to protect this information from unauthorized access and disclosure. Under the Health Insurance Portability and Accountability Act (HIPAA), as well as state consumer protection statutes such as the Illinois Personal Information Protection Act, healthcare organizations and their management entities are legally obligated to implement robust administrative, physical, and technical safeguards. The occurrence of a data breach of this magnitude strongly indicates potential failures in network segmentation, vulnerability patch management, or continuous monitoring protocols, representing a prima facie failure of the organization's legal obligations to secure confidential patient and employee data. Receiving an official data breach notification letter from FYZICAL Acquisition Holdings, LLC serves as formal acknowledgment that an individual's private information was compromised due to corporate security shortcomings, and it establishes the legal standing necessary to participate in a class action lawsuit. Affected individuals should be aware that under established consumer protection law, plaintiffs are not required to demonstrate actual financial loss or identity theft to seek legal recourse and compensation for the increased risk and distress caused by the exposure. Our law firm is currently investigating potential legal claims against FYZICAL Acquisition Holdings, LLC on a contingency fee basis, meaning affected class members pay absolutely no upfront costs or out-of-pocket expenses, and attorneys' fees are recovered only if a successful settlement or judgment is secured.

Based on the data types reported in this filing, affected individuals face the following specific risks:

Under the Illinois Personal Information Protection Act (PIPA), you may have a legal claim against FYZICAL ACQUISITION HOLDINGS, LLC if any of the following apply:

• You received a written data breach notification letter from FYZICAL ACQUISITION HOLDINGS, LLC
• You are or were a customer, patient, or employee of FYZICAL ACQUISITION HOLDINGS, LLC
• Your information was held by FYZICAL ACQUISITION HOLDINGS, LLC in IL
• Your bank or payment card data was potentially exposed
• Your protected health information was stored in the compromised system

Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.