The county is now preparing to notify those affected by the breach.
The incident became public last week, when the Chattanooga Times Free Press reported on a confidential March 11 memo from the county attorney's office suggesting the county was alerted to the issue in July and had failed to notify affected people within 60 days as required by law.
The mayor said Tuesday that the July email from National Recovery Service — a debt collection agency in Cleveland, Tennessee — did not meet the requirements for an official notice of a data breach and such notice did not arrive until February.
The notification window is still active," Wamp said in a meeting with the Times Free Press on Tuesday. "We're within the 60-day window."
Further, Wamp said, he was unaware of the matter until he received the March 11 memo.
Nature and Scope
The July email said the collection agency had noticed suspicious activity within its network and was investigating.
"Our investigation to date has confirmed that this activity is the result of a cybersecurity event," the email said. "While our investigation is ongoing, we are working to confirm the full nature and scope of the event, including any impact to your organization. We will provide additional information as our investigation progresses, including if we identify any specific impact to your data."
The incident was reported to federal law enforcement, the email said.
According to Wamp, that email did not qualify as notification to the county requiring that affected ambulance customers be alerted.
"It's very clearly not a notification," Wamp said. "In fact the word breach is not in the email."
Nationwide sent more formal notification in a Feb. 17 letter that was received by the county on Feb. 24 — a letter that started the clock ticking on a 60-day window to notify affected customers, officials said Tuesday.
"The information that may be potentially impacted likely includes name, address, Social Security number, date of birth, financial account information and/or medical related information," the letter said.
Federal Notice
Nationwide Recovery Services informed the U.S. Department of Health and Human Services of the breach in September. A listing of data breaches under investigation by the U.S. Department of Health and Human Services's civil rights office shows that Nationwide Recovery Services reported a "hacking/IT incident" on Sept. 9.
And five months later, in the letter dated Feb. 17, Nationwide Recovery Services followed up with the county.
"We are writing to inform you that we recently determined the incident may impact the security of certain information related to individuals associated with Hamilton County EMS," representatives of Nationwide Recovery Services said. "Although we have no evidence to suggest there has been identity theft or fraud related to this incident, NRS is providing this notice to make you aware of the incident."
As of last week, county officials told a television station that no breach had been confirmed. This week, county officials said that the breach occurred, but that the county has 60 days from Feb. 24 to meet a federal requirement that those affected, and the public, be notified.
The shift is partially attributable to a difference in interpretation of law, said Janie Varnell, an attorney and special adviser to Wamp and the county commission. She told the Times Free Press that the notification clock began to tick after the county received a second communication from the debt collection firm in February. That timeline differs from what the county attorney's office said in its March 11 memo.
"Once I saw and read them, I came to a different conclusion than what was in the memo about whether the July 2024 email constituted notification of a breach," Varnell said Tuesday. "It's my firm belief that we were not in violation."
Wamp has been at odds with longtime County Attorney Rheubin Taylor since taking office in 2022. The mayor attempted unsuccessfully to fire Taylor as one of his first acts in office. Taylor succeeded in staying in office until his term ends in June of this year, although Wamp has brought Varnell on as an adviser and successor to Taylor.
Wamp suggested Tuesday that the March 11 memo from the county attorney's office was not just designed to protect the privacy of ambulance customers.
"Certainly motive exists, and has existed, to make the operations of county government look bad, Wamp said.
© 2025 the Chattanooga Times/Free Press (Chattanooga, Tenn.). Distributed by Tribune Content Agency, LLC.
