Data breach at medical billing firm MCBS affects 1.26 million people
MCBS medical billing breach exposes 1.26M patient records after September 2025 network compromise.
Medical Computer Business Services (MCBS), a Georgia-based healthcare billing firm, disclosed a network breach occurring between September 22–26, 2025, affecting 1,261,464 individuals. The PEAR ransomware group claimed responsibility and alleged exfiltration of 3.3 terabytes of data, including patient medical records, SSNs, insurance details, and HR information. The incident was formally reported to HHS in late June 2026, with the investigation completed in May 2026.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Medical Computer Business Services (MCBS)?
Get an email when a new story names Medical Computer Business Services (MCBS), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMCBS suffered a multi-day ransomware intrusion that went undetected long enough for attackers to exfiltrate 3.3 terabytes of highly sensitive healthcare data, including SSNs, medical records, and insurance details. The fact that the breach spanned four days suggests insufficient real-time monitoring and alerting on the network. Critically, the incident was not reported to HHS until approximately nine months after the breach occurred, raising serious HIPAA compliance concerns around the 60-day breach notification deadline. Third-party medical billing firms are high-value targets because they aggregate sensitive data from multiple healthcare providers, making robust data governance and rapid response essential. Delays in notification leave affected individuals unable to protect themselves from identity theft and fraud.
What helps against this
How we list vendors- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — PEAR
- malware — PEAR ransomware