Restoration Counseling, operated as Restoration Counseling LLC by licensed clinical mental health counselor Rose Poney, is a Vermont healthcare provider that has reported a data security incident to the U.S. Department of Health and Human Services. The filing lists 662 affected individuals and identifies the incident as a hacking or IT incident involving email.
Restoration Counseling’s Data Breach Investigation
Attorneys are investigating the data breach reported by Restoration Counseling. According to the breach portal maintained by the HHS Office for Civil Rights, the practice submitted its report on October 16, 2026. The entry classifies the covered entity as a healthcare provider located in Vermont, lists 662 individuals as affected, categorizes the event as a hacking/IT incident, and names email as the location of the breached information.
That federal filing is a compliance record rather than a narrative notice, so it does not describe how an unauthorized party got into the email environment, how long access lasted, or which specific personal details were exposed. Restoration Counseling has not made those details public in any source reviewed so far, and none are assumed here. What the filing does establish is that the practice itself determined the incident was serious enough to meet the federal reporting threshold for breaches affecting 500 or more people.
Email accounts are a common point of compromise for small healthcare practices. A single mailbox can hold appointment confirmations, intake paperwork, insurance correspondence, billing records, and messages between a clinician and the people in her care. When an outside party reaches that kind of mailbox, the contents can reveal far more than a name and address. For a counseling practice in particular, even the fact that someone was a client can be sensitive, which is why the handling of this incident matters to the people whose information was involved.
Investigators are looking at whether Restoration Counseling took reasonable steps to safeguard the email systems that held client information, whether affected people were notified promptly, and what protections or support were offered afterward. Anyone who receives a notice from the practice should keep it, since it will describe the specific categories of information tied to the recipient.
When Did This Breach Occur?
Restoration Counseling reported the incident to federal regulators on October 16, 2026. The dates when unauthorized access began, when it was discovered, and when notification letters were sent have not been publicly disclosed.
What Information Was Breached?
The specific types of information involved have not been publicly disclosed. The federal filing identifies email as the location of the breached information. Email accounts at a counseling practice can contain names, contact details, insurance information, billing details, and treatment-related messages, but Restoration Counseling has not confirmed which of these, if any, were involved in this incident.
What You Can Do
If you are a current or former client of Restoration Counseling, consider these steps:
- Read any notice you receive from the practice carefully and keep a copy for your records.
- Review insurance statements and Explanation of Benefits forms for services you did not receive.
- Monitor your financial accounts and credit reports for activity you do not recognize.
- Consider placing a fraud alert or credit freeze with the major credit bureaus.
- Be cautious with unexpected emails, texts, or calls that mention your counseling or health care, and do not click links or share personal details in response.
File a Data Breach Lawsuit Against Restoration Counseling
If you received a notice or believe your personal or health information may have been exposed in the Restoration Counseling data breach, you may have legal options. Class action lawsuits can allow affected people to seek compensation for the harm caused by a breach as a group.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
