Restorative Therapies, Inc., a healthcare technology company based in Nottingham, Maryland, that specializes in advanced rehabilitation and neuromuscular electrical stimulation devices, has notified the Vermont Attorney General’s office of a data security incident affecting personal information.
Companies that store personal and health-related information about their patients and customers have a responsibility to keep that information secure, and individuals affected by a breach deserve a clear explanation of what happened and what they can do to protect themselves.
Restorative Therapies, Inc.’s Data Breach Investigation
Restorative Therapies, Inc. is a healthcare technology company headquartered in Nottingham,
Maryland, that develops functional electrical stimulation and advanced rehabilitation
technologies used by patients and clinicians to help restore mobility after neurological
injury. In September 2026, the company notified the Vermont Attorney General’s office of a
data security incident, reporting that at least one Vermont resident’s personal information may
have been affected.
Public reporting from cybersecurity researchers indicates that a ransomware group calling
itself AiLock claimed responsibility for a cyberattack against Restorative Therapies, Inc. in
late May 2026, stating that it had exfiltrated data from the company’s network and threatening
to publish it if the company did not negotiate. Restorative Therapies has not publicly detailed
the scope of the incident, and it is not yet known publicly how many individuals nationwide were
ultimately affected or notified.
Because Restorative Therapies works with rehabilitation clinics, home health providers, and
patients directly, an incident involving its systems has the potential to expose sensitive
personal and health-related information belonging to a wide range of people who relied on the
company’s devices or services, even if they never interacted with the company’s own network
directly. Companies that provide medical devices and rehabilitation technology often maintain
detailed records tied to patients’ medical histories and insurance information, which makes
them attractive targets for cybercriminals seeking to monetize stolen data.
State attorney general notification requirements exist precisely so that residents can learn
when their information may have been compromised, even in cases affecting only a small number
of people in a particular state. A single-resident notification to a state like Vermont does not
necessarily mean the underlying breach was small; it typically means the company is required to
separately notify each state’s regulator once even one resident of that state is identified
among those affected, regardless of how many other people nationwide were also impacted.
As with many corporate data security incidents, additional details, including the exact
number of individuals affected and the specific categories of information involved, may not
become fully clear until further state filings or investigations are made public. Individuals
who receive a direct notification letter from Restorative Therapies should read it carefully, as
it will contain information specific to their own situation.
When Did This Breach Occur?
Public reporting indicates that a ransomware group identified as AiLock claimed responsibility
for an attack on Restorative Therapies, Inc.’s network on or around May 29, 2026. Restorative
Therapies notified the Vermont Attorney General’s office of a related data security incident in
September 2026. The company has not publicly disclosed the exact dates its network was accessed
or when the intrusion was first discovered internally.
What Information Was Breached?
Restorative Therapies has not publicly disclosed a complete list of the specific categories of
information involved in this incident. Given the nature of the company’s business providing
rehabilitation technology and services to patients, information at risk in an incident like this
can potentially include names, contact information, and health-related or insurance information
tied to the company’s patients and customers. Individuals who receive a direct notification
letter from the company should review it closely, as it will list the specific types of
information the company has determined may have been involved.
What You Can Do
If you receive a notification letter from Restorative Therapies, Inc., follow any instructions
it provides, including how to enroll in any credit monitoring or identity protection services
that may be offered. In the meantime, there are several general steps you can take to help
protect yourself:
- Regularly review your bank, credit card, and insurance statements for unfamiliar activity.
- Request a free copy of your credit report from each of the three major credit bureaus at
annualcreditreport.com and review it for accounts you don’t recognize.
- Consider placing a fraud alert or a security freeze on your credit file with Equifax,
Experian, and TransUnion.
- Be cautious of phishing emails, calls, or texts referencing this incident, and never provide
personal information in response to an unsolicited request.
- Report any signs of identity theft or fraud to your state Attorney General and the Federal
Trade Commission.
File a Data Breach Lawsuit Against Restorative Therapies, Inc.
If you were notified that your personal information was involved in a data security incident
at Restorative Therapies, Inc., you may have legal options available to you. Companies that
collect and store sensitive personal and health-related information have a responsibility to
protect that data, and individuals affected by a data breach may be entitled to compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
