- A breach at healthcare billing firm MCBS may have exposed sensitive data linked to 1.26 million people.
- The exposed information may include names, Social Security numbers, medical details, and insurance records.
- The PEAR ransomware group claims it stole more than 3 TB of data from the company.
A data breach at US healthcare billing firm Medical Computer Business Services, or MCBS, may have affected 1,261,464 people.
The company provides billing and management services to healthcare organisations. Its work includes medical billing, coding, payment services, and administrative support.
According to BleepingComputer, attackers accessed MCBS systems between September 22 and 26, 2025. MCBS then began investigating the incident to understand what information attackers may have accessed or removed.
The company completed its review on May 28, 2026. MCBS later reported the number of potentially affected people to the US Department of Health and Human Services.
The filing listed 1,261,464 people as potentially affected by the breach. SecurityWeek and HIPAA Journal also reported the figure. HIPAA Journal said the affected records belonged to patients of healthcare organisations that use MCBS services.
Details of the Data Exposure
The information involved may differ from one person to another. According to MCBS’s breach notice, the exposed data may include full names and physical addresses. It may also include Social Security numbers and dates of birth. Some health information may also have been involved in the incident.
This information may include health plan numbers and health insurance policy numbers. It may also contain subscriber identification numbers and details about medical histories.
Other records may include information about physical and mental health conditions. Medical treatment details and diagnosis information may also have been part of the affected data. The value of such information is significant, analysis has found that medical records can sell for up to $300 on cybercrime markets.
HIPAA Journal reported that MCBS found possible access to files containing protected health information. The investigation also found that some of these files may have been taken from the company’s network.
MCBS identified seven healthcare organisations whose patient information it handled as a business associate. These organisations may have had patients affected by the incident.
The breach has also been linked to the PEAR, or Pure Extraction and Ransom, ransomware group. According to SecurityWeek, PEAR claimed it stole more than 3 TB of data from MCBS. BleepingComputer reported a similar claim involving about 3.3 TB of data.
The group claims the stolen information goes beyond patient records. The alleged data includes company and client financial records, human resources files, and business documents. It also reportedly includes partner and vendor information, payment records, emails, and databases.
However, BleepingComputer said it had not reviewed the alleged stolen data. The publication therefore could not independently confirm whether the claimed data was genuine.
What Affected People Should Know
MCBS has advised people who may have been affected to consider taking steps to protect their credit. The company recommends placing a fraud alert or security freeze on credit files.
People who received medical care in Georgia can also contact their healthcare providers. They can ask whether their providers work with MCBS and whether their information may have been involved.
The incident shows the risks that can arise when healthcare companies share sensitive information with outside service providers. Companies that handle billing and administrative work may hold large amounts of personal and medical data. A security incident at one service provider can therefore affect patients connected to several healthcare organisations.
The MCBS case also shows why people should pay attention to breach notices. Affected individuals should follow official instructions from MCBS or their healthcare providers. They should also watch their accounts and look for unusual activity linked to their personal information.
People should report suspicious activity to the relevant company or financial institution as soon as possible. The breach investigation and related claims continue to raise questions about the full amount of information involved. For now, the number reported to US health authorities remains 1,261,464 potentially affected individuals.
