MCBS, a medical billing and revenue cycle management company, has disclosed that a network breach compromised personal and health information belonging to 1.26 million individuals, according to a filing with the HHS Office for Civil Rights.
MCBS detected unauthorized access to its network on or about Sept. 25, 2025, and later determined the intrusion occurred between Sept. 22 and Sept. 26, 2025. The company said it did not confirm which files were affected until May 28, 2026, following an extensive forensic investigation and manual review, and posted a public notice in late June without disclosing a total figure.
The compromised information includes names, addresses, Social Security numbers, dates of birth, health plan beneficiary numbers, health insurance policy or subscriber identification numbers, and medical history, diagnosis and treatment information. The specific data exposed varies by individual.
MCBS’s breach notice lists seven covered-entity clients whose patients may be affected, including South Georgia Radiology Consultants, Radiation Oncology Associates and Vascular Radiology Associates II, all based in the Augusta, Ga., area. The company said it has no evidence of identity theft tied to the incident but recommends affected individuals monitor their financial accounts.
The ransomware group PEAR, short for Pure Extortion and Ransom, claimed responsibility for the attack and alleged it exfiltrated 3.3 terabytes of data, cybersecurity news outlets have reported. MCBS has not addressed the claim in its public notice.
The incident adds to a string of large-scale breaches tied to third-party medical billing and revenue cycle vendors, a growing cybersecurity exposure point for hospitals and physician practices that outsource back-office data processing.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.