MCBS ransomware attack steals 3TB of patient data

Published July 27, 2026

MCBS, a medical billing company, says attackers broke into its network and took files on about 1.2 million patients, including Social Security numbers and health details. The Pear ransomware group claims it stole roughly 3 terabytes of data in the break-in.

Report priority
High
Group
MCBS

What is known

  • Someone got into MCBS's network between September 22 and 26, 2025, and copied files before the company noticed and shut off the access.
  • The Pear ransomware group later claimed credit and said it took about 3 terabytes of data.

What to do

MCBS says it mailed written notices to everyone whose information was in the affected files, so check your mail (or call MCBS at 844-959-7135) rather than trying to check this yourself online.

MCBS says it has found no evidence of identity theft so far but recommends placing a fraud alert or credit freeze with the credit bureaus and watching financial and insurance statements for unusual activity.

Reported details

An unauthorized user gets into MCBS's network in late September 2025 and spends several days copying files before anyone notices. The Pear ransomware group later claims responsibility and says it took roughly 3 terabytes of data, including patient billing and health records, company financials, HR files, and vendor data. Pear points to the stolen files as proof, the same pressure tactic it has used against other healthcare targets to push for a ransom payment.

MCBS discovered unauthorized network access on September 25, 2025, and later determined intruders may have accessed or removed files between September 22 and 26, 2025. A manual review completed May 28, 2026 found the files could include names, addresses, Social Security numbers, dates of birth, health plan beneficiary numbers, insurance policy or subscriber IDs, medical history, and diagnosis information. The Pear ransomware group, which has hit several other healthcare providers with data-theft-and-leak extortion, claimed the attack and said it took over 3TB of data. State filings show 295,625 affected in South Carolina, 13,302 in Texas, and 382 in Massachusetts; HHS records list 1,261,464 individuals total.

References

View Original Source