[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3OpOrngJBl_QgDIzsj7Zl7ijCfXYZ_V5y5BqMHkJgK0":3},{"article":4,"iocs":56,"watch_terms":64,"solutions":65,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"51a5bfcf-6056-41f9-8c81-98869bd46079","Data breach at medical billing firm MCBS affects 1.26 million people","data-breach-at-medical-billing-firm-mcbs-affects-1-26-million-people-641ea5","Healthcare billing company Medical Computer Business Services (MCBS) has disclosed that a 2025 network breach exposed the sensitive information of more than 1.2 million people. [...]","Medical Computer Business Services (MCBS), a Georgia-based healthcare billing firm, disclosed a network breach occurring between September 22–26, 2025, affecting 1,261,464 individuals. The PEAR ransomware group claimed responsibility and alleged exfiltration of 3.3 terabytes of data, including patient medical records, SSNs, insurance details, and HR information. The incident was formally reported to HHS in late June 2026, with the investigation completed in May 2026.","MCBS medical billing breach exposes 1.26M patient records after September 2025 network compromise.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fdata-breach-at-medical-billing-firm-mcbs-affects-126-million-people\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F12\u002F30\u002Fhealthcare-security.jpg","2026-07-28T09:10:03+00:00","2026-07-28T10:00:18.316357+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Medical Computer Business Services (MCBS)","vendor",{"name":21,"type":22},"PEAR (Pure Extraction and Ransom)","threat_actor",{"name":24,"type":25},"MCBS Billing & Practice-Management Platform","product",{"name":27,"type":19},"South Georgia Radiology Consultants",{"name":29,"type":19},"SkinPath Solutions","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":30,"icon":32,"name":33,"slug":34},null,"Breaches","breaches",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"fbace4ad-a9f5-407c-b73c-88cd9d221ecc","HIPAA","hipaa",[57,61],{"type":58,"value":59,"context":60},"malware","PEAR","Pure Extraction and Ransom ransomware group claiming responsibility for MCBS breach and data exfiltration",{"type":58,"value":62,"context":63},"PEAR ransomware","Ransomware variant used in the attack; group claims 3.3TB data exfiltration",[18,27,29],{"controls":66,"vendors":151},[67,96,122],{"slug":68,"name":69,"problem":70,"products":71},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":97,"name":98,"problem":99,"products":100},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":118,"product_name":119,"url":120,"description":121},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"slug":123,"name":124,"problem":125,"products":126},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[],{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":169},"ransomware-breach-at-medical-billing-firm-exposes-126-million-patient-records","Ransomware Breach at Medical Billing Firm Exposes 1.26 Million Patient Records","MCBS suffered a multi-day ransomware intrusion that went undetected long enough for attackers to exfiltrate 3.3 terabytes of highly sensitive healthcare data, including SSNs, medical records, and insurance details. The fact that the breach spanned four days suggests insufficient real-time monitoring and alerting on the network. Critically, the incident was not reported to HHS until approximately nine months after the breach occurred, raising serious HIPAA compliance concerns around the 60-day breach notification deadline. Third-party medical billing firms are high-value targets because they aggregate sensitive data from multiple healthcare providers, making robust data governance and rapid response essential. Delays in notification leave affected individuals unable to protect themselves from identity theft and fraud.",[157,158,159,160,161,162,163,164,165,166,167,168],"HIPAA Security Rule 45 CFR § 164.306 – Security Standards","HIPAA Breach Notification Rule 45 CFR § 164.404 – 60-day notification requirement","NIST CSF PR.DS-1 – Data-at-rest protection","NIST CSF DE.CM-1 – Network monitoring","NIST CSF RS.CO-2 – Incident reporting","NIST SP 800-66 Rev. 2 – HIPAA Security Rule implementation guidance","CIS Control 3 – Data Protection","CIS Control 13 – Network Monitoring and Defense","CIS Control 17 – Incident Response Management","NIST AC-6 – Least Privilege","NIST IR-6 – Incident Reporting","NIST SC-7 – Boundary Protection (Network Segmentation)",{}]