2025 MCBS — PEAR ransomware; HHS 1,261,464 individuals (Atlanta medical billing)
Data compromised
Per MCBS notice: name, address, Social Security number, date of birth, health plan beneficiary number, health insurance policy/subscriber IDs, other health insurance information, medical history, mental or physical condition, medical treatment information, and diagnosis information (varies by person). PEAR also claimed company/client financials, HR docs, partner/vendor data, payment details, and emails.
Technical writeup
Verified healthcare business-associate breach — company notice and HHS OCR count. Atlanta-based Medical Computer Business Services (MCBS), a medical revenue cycle management and billing firm, detected unauthorized network access on or about September 25, 2025. Forensic review found an unauthorized user may have accessed or removed files between September 22 and September 26, 2025. On May 28, 2026, MCBS determined impacted files could include names, addresses, SSNs, dates of birth, health insurance identifiers, medical history, conditions, treatment, and diagnosis information. HHS OCR lists 1,261,464 individuals affected. The company notice names seven covered entities whose data was in scope: C&C MD PC; Nuclear Medicine and Pathology Associates; Radiation Oncology Associates, LLP; SkinPath Solutions, LLC; South Georgia Radiology Consultants PC; Stephen W. Brown & Radiology Associates of Augusta, LLP; and Vascular Radiology Associates II, LLP. SecurityWeek (July 27, 2026) reported that the PEAR ransomware group claimed the MCBS intrusion in late September 2025 and alleged more than 3 TB of stolen files including patient PII/PHI, financials, and emails, and that stolen data was posted for download on the PEAR leak site. MCBS stated it had no evidence of identity theft related to the incident and published consumer guidance including a contact line (844) 959-7135.
Root cause
Unauthorized network access September 22–26, 2025; PEAR ransomware group claimed responsibility and alleged ~3 TB exfiltration; MCBS company notice and HHS OCR filing confirm impact