Data breach at medical billing firm at MCBS

Information:

   Medical Computer Business Services (MCBS) is a private company based in Georgia, USA, that specializes in providing medical billing and practice management services to healthcare organizations. Acting as a healthcare data aggregator, MCBS handles back-office operations for various hospitals and specialty clinics, such as radiology and pathology practices. Their comprehensive services include medical billing and coding for insurance claims, accounts receivable management, and handling administrative and financial tasks related to patient records. By managing these complex financial and administrative processes, MCBS helps healthcare providers reduce their paperwork burden, allowing them to focus entirely on patient care.

Incident :

  Between September 22 and 26, 2025, unauthorized actors gained access to the firm’s network. After an extensive forensic investigation that concluded in late May 2026, the company confirmed that sensitive personal and health information including names, addresses, Social Security numbers, health insurance details, and medical histories had been compromised. Because MCBS acts as a third-party administrative vendor for various healthcare providers, such as radiology and pathology clinics, many of the affected patients likely had no direct relationship with or knowledge of the company.

  The PEAR ransomware group has claimed responsibility for the cyberattack. Unlike traditional ransomware that focuses on encrypting files, PEAR’s primary tactic is data theft and extortion. The group claims to have exfiltrated 3.3 terabytes of data from MCBS. Beyond the patient records acknowledged by the company, the hackers assert they have also stolen internal HR documents, payment information, business operations data, and emails, which they claim to have already leaked online.

  MCBS began notifying affected individuals and the U.S. Department of Health and Human Services in late June 2026. The company is urging those potentially impacted to monitor their financial accounts, place fraud alerts, and consider instituting credit freezes to protect themselves against identity theft. This breach highlights a growing cybersecurity vulnerability in the healthcare sector, where intermediary back-office vendors become prime targets due to the vast amounts of sensitive data they aggregate from multiple providers.

Recommendation :

  Access Control & Segmentation: To minimize third-party vendor risks, enforce the principle of least privilege. Segment external vendor networks away from your core internal databases to prevent attackers from using them as a stepping stone for lateral movement.SIEM

  Monitoring & Analysis: Since this threat group focuses on stealing data rather than encrypting it, configuring alerts on your SIEM (like QRadar or Splunk) is crucial. Correlate security events (such as endpoint activity) with network flows (traffic volume) to detect abnormal spikes in outbound bandwidth, especially outside of standard business hours.

  Threat Hunting: Focus on anomalous Identity and Access Management (IAM) activity, such as suspicious privilege escalation attempts or unusual MFA prompt fatigue. Additionally, monitor outbound traffic for connections sending data to unauthorized external cloud storage services.

The important things is Security systems. We must concern and monitor as usual.
For more information please contact
Email :sales@inetms.co.th
065 149 2822 (Ms.Suphatson )
063 204 4534 (Ms.Atsamaphorn)
065 929 6330 (Ms.Kansinee)
092 257 6902 (Ms.Narusorn)
063 197 7510 (Mr.Yanotai)
065 725 7405 (Ms.Nattharini)

References :

• https://www.bleepingcomputer.com/news/security/data-breach-at-medical-billing-firm-mcbs-affects-126-million-people/

Weekly Interesting CVE

Malware News or Campaign IOC/IOA | EN

Ref: https://www.theregister.com/cyber-crime/2026/07/07/cai-cloud-worm-gives-competitors-malware-the-boot-then-steals-secrets-and-mines-for-coin/5267856