MCBS breach impacts records of 1.26 million individuals

Medical Computer Business Services (MCBS) has revealed that a 2025 network intrusion compromised the personal information of 1,261,464 people.

MCBS reports breach details to HHS. The medical billing firm first revealed the security event late last month while omitting any count of those affected. In its mandatory notice to the U.S. Department of Health and Human Services, MCBS stated that exactly 1,261,464 individuals were impacted.

The firm finished its internal probe on May 28, 2026. Investigators concluded that intruders had obtained unauthorized network access from September 22 to 26, 2025.

Exposed data includes names, SSNs, and medical details. The breach reportedly exposed full names, physical addresses, Social Security numbers, dates of birth, health plan beneficiary numbers, health insurance policy numbers, subscriber identification numbers, medical history, mental and physical condition, medical treatment information, and diagnosis information. MCBS stressed that the precise elements exposed differ for each person.

Headquartered in Augusta, Georgia, MCBS operates as a regional private medical billing and practice-management provider. It supplies billing, coding, accounts receivable, financial, and administrative services to healthcare organizations while functioning as a healthcare data aggregator that processes patient records on behalf of providers.

Seven covered entities are linked to the breach. The public notice names seven covered entities—healthcare providers for whom MCBS processed records as a business associate. Among them are South Georgia Radiology Consultants, SkinPath Solutions, and Stephen W. Brown and Radiology Associates.

MCBS posted the notification to its website in late June. It recommends that anyone potentially affected file a fraud alert and weigh a credit-file security freeze. Residents of Georgia who obtained medical care are told to reach out to their provider to learn whether that provider uses MCBS and whether their records were involved.

PEAR ransomware group claims responsibility. The PEAR (Pure Extraction and Ransom) ransomware operation has asserted responsibility for the intrusion. The group alleges it removed 3.3 terabytes of data from MCBS systems. Beyond the client records listed in the company’s disclosure, the attackers also claim possession of human-resources files, business-operation records, payment details, email messages, and multiple databases. The stolen cache has since been published online in full.