Data breach at medical billing firm MCBS affects 1.26 million people

Medical billing company Medical Computer Business Services disclosed Tuesday that a 2025 network breach exposed the sensitive information of 1,261,464 people. The Augusta, Georgia-based firm reported the figure in a disclosure to the U.S. Department of Health and Human Services. MCBS published a notification on its website in late June informing that threat actors gained unauthorized access to its network between Sept. 22 and 26, 2025. The company completed an investigation on May 28 determining that data including full names, Social Security numbers, dates of birth, health insurance details, and medical history may have been exposed. The notice lists seven covered entities, including South Georgia Radiology Consultants and SkinPath Solutions, whose patient data MCBS handled as a business associate. The PEAR ransomware group has claimed responsibility for the attack, alleging it exfiltrated 3.3 terabytes of data that has since been leaked online. MCBS urges potentially affected individuals to place a fraud alert and consider a security freeze on their credit file.