Loading story…
Medical Computer Business Services (MCBS), a Georgia-based medical billing and practice-management firm, disclosed that a September 2025 network intrusion exposed the personal, insurance, and medical information of 1,261,464 individuals. The company said unauthorized actors accessed its systems between September 22 and September 26, 2025, and that the compromised data may include names, addresses, Social Security numbers, dates of birth, insurance identifiers, medical histories, diagnoses, and treatment details. MCBS reported that the affected records were tied to data it managed for seven healthcare organizations.
The incident has been linked to the PEAR ransomware group, which claimed responsibility shortly after the intrusion and alleged it stole more than 3 TB of data, including patient PII/PHI, financial records, HR documents, payment information, and emails. MCBS said its investigation concluded on May 28, 2026, while U.S. Department of Health and Human Services breach-tracker data lists the event among major healthcare breaches, underscoring the scale of the exposure and the risk to patients and partner providers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
MCBS said it completed its investigation into the 2025 network breach on May 28, 2026, determining that sensitive personal and medical information may have been exposed.
MCBS said unauthorized actors had access to its network between September 22 and September 26, 2025, during a cyberattack that exposed data handled for multiple healthcare organizations.
MCBS disclosed that the September 2025 cyberattack affected 1,261,464 individuals, with HHS breach-tracker data reflecting the same scale and the company saying data tied to seven healthcare organizations was compromised.
In late September 2025, the PEAR ransomware group claimed responsibility for the MCBS attack and said it stole more than 3 TB of data, including patient, financial, HR, payment, and email records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcebleepingcomputer.com
Open sourcesecurityweek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Brown Health Medical Group-MA disclosed a data breach affecting **311,760 individuals** after unauthorized activity was discovered on a legacy file server at its Hawthorn location in December 2025. The organization said the intrusion was limited to that historic file server and did **not** affect its electronic medical record or electronic health record systems, but a June 22, 2026 review found that files on the server had been accessed. The exposed information potentially included names, contact details, dates of birth, Social Security numbers, driver’s license and other government ID numbers, medical and disability records, financial account information, payment card data, and employment-related records. Brown Health Medical Group-MA reported the incident to the **HHS Office for Civil Rights** and state authorities in Massachusetts and Vermont, said no threat actor had been publicly identified or linked to a ransomware or extortion claim, and is offering affected individuals **24 months** of credit monitoring, fraud detection, and identity theft protection services.
Aug 6, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026
Multiple U.S. healthcare organizations have recently disclosed data breaches resulting from unauthorized access to sensitive patient information. Expert MRI, a radiology provider in California, reported that an attacker accessed its network between June and August 2025, exfiltrating data such as names, addresses, dates of birth, diagnoses, and, for some, Social Security numbers. The PEAR threat group claimed responsibility and briefly listed stolen data on its leak site, suggesting a ransom may have been paid. Revere Health in Utah experienced a breach of a third-party payment platform, potentially exposing patient names, dates of birth, addresses, medical record numbers, and partial Social Security numbers, though no evidence of misuse was found. Health Management Systems of America in Michigan disclosed a breach after an employee fell victim to a spear phishing attack, resulting in the unauthorized download of emails containing patient data. These incidents highlight the ongoing risks faced by healthcare organizations from both targeted ransomware groups and opportunistic phishing attacks. In response, affected providers have reported the breaches to regulators, enhanced their cybersecurity measures, and offered credit monitoring to impacted individuals. The number of affected patients varies by incident, with Revere Health reporting up to 10,800 impacted and Expert MRI yet to disclose a total. The breaches underscore the importance of robust security practices and employee awareness training to mitigate the risk of data compromise in the healthcare sector.
Jun 29, 2026