1.26 Million Patients Hit As Medical Breach Exposes Social Security Info
MCBS, an Augusta-headquartered company, which provides billing, coding, accounts receivable, and administrative services for healthcare providers, disclosed the full scale of the breach in a filing with the U.S. Department of Health and Human Services. According to the company's statement, hackers gained access to MCBS systems between September 22 and September 26, 2025. Following a multi-month investigation only completed this late May, the firm confirmed that cybercriminals successfully compromised a vast trove of sensitive patient data.
As a third-party practice-management vendor, MCBS aggregates patient records on behalf of numerous clinical entities. Consequently, the breach impacts patients across several regional medical providers, including South Georgia Radiology Consultants, SkinPath Solutions, and Stephen W. Brown and Radiology Associates. The precise data exposed varies per individual, but the stolen files contain a combination of personal markers and medical details, including full names, physical addresses, Social Security numbers, dates of birth, health plan beneficiary numbers, and insurance policy details. Clinical data, ranging from medical histories and diagnosis reports to mental and physical health conditions and specific treatment details, was also accessible to the attackers.
So far, the extortion group known as PEAR (Pure Extraction and Ransom) has claimed responsibility for the intrusion, whereby they allege exfiltrating 3.3 terabytes of data from MCBS networks. Outside of PHI, PEAR claims to have stolen internal HR files, corporate financial details, payment processing records, email correspondence, and administrative databases. The group has since published the entire stolen data cache online, creating increased risks of identity theft, financial fraud, and targeted spear-phishing campaigns for those affected.
This incident (along with so many others we've covered) underscores the vulnerability of healthcare supply chains, where third-party billing and administrative vendors serve as high-value targets for cybercrime syndicates.
