MCBS Data Breach Exposes 1.26 Million Patients' Information

Medical Computer Business Services (MCBS) disclosed a network breach affecting 1.26 million individuals, with the incident originating between September 22 and 26, 2025. Attackers gained unauthorized access to sensitive patient and billing information, including personal identifiers and financial data. The breach was reported to the U.S. Department of Health and Human Services, and MCBS confirmed the exposure of data from multiple healthcare providers. The PEAR ransomware group claimed responsibility, alleging they exfiltrated 3.3 terabytes of data, including human resources and operational details. MCBS has advised affected individuals to monitor their credit files and consider placing fraud alerts. The investigation into the breach concluded on May 28, 2026, raising concerns about the delay in public disclosure. The breach highlights vulnerabilities in medical billing systems, which are often less scrutinized than clinical systems.

Key Points: • MCBS breach affects 1.26 million individuals, with sensitive data exposed. • The PEAR ransomware group claimed responsibility for the attack. • Healthcare providers must assess their notification obligations under HIPAA.