MCBS Breach Exposes Data of 1.26 Million People
Summary
MCBS says attackers accessed its network in September 2025, potentially exposing sensitive information belonging to 1,261,464 people. PEAR claimed to have stolen 3.3 terabytes, but the outlet could not validate the leaked data’s authenticity.
Key points
- MCBS disclosed unauthorized network access from September 22 to 26, 2025.
- The company reported that 1,261,464 people were impacted after completing its investigation on May 28, 2026.
- Potentially exposed information includes Social Security numbers, health insurance details, medical history, diagnoses, and treatment information; data varied by individual.
- MCBS handled patient data for seven healthcare entities, including South Georgia Radiology Consultants, SkinPath Solutions, and Stephen W. Brown and Radiology Associates.
- The PEAR ransomware group claimed it exfiltrated 3.3 terabytes of data. The outlet said it did not examine the cache and could not verify its authenticity.
- MCBS urged potentially affected individuals to consider a fraud alert or credit freeze and advised Georgia patients to ask their healthcare provider whether it works with MCBS.
Article Details
- Victim Organization
- Medical Computer Business Services (MCBS)
- Incident Type
- Network breach claimed by the PEAR ransomware group; MCBS reported unauthorized network access.
- Disclosure Date
- 2026-06-01
- Data Types Exposed
- Full names
- Physical addresses
- Social Security numbers
- Dates of birth
- Health plan beneficiary numbers
- Health insurance policy numbers
- Subscriber identification numbers
- Medical histories
- Mental and physical condition information
- Medical treatment information
- Diagnosis information
- Affected Records
- 1,261,464 people
- Affected Data Size
- The PEAR ransomware group alleges it exfiltrated 3.3 terabytes of data; this is unverified.
- Operational Impact
- MCBS reported unauthorized access to its network between September 22 and 26, 2025. The article does not report operational disruption.
- Ransom Or Extortion
- The PEAR ransomware group claimed the attack and alleged data exfiltration; the article says the data was fully leaked online, but BleepingComputer did not examine the cache and could not validate its authenticity. No ransom demand is reported.
- Claim Status
- claimed