MCBS Data Breach Exposes 1.2 Million Records via PEAR Ransomware

Atlanta-based medical revenue cycle management company MCBS (Medical Computer Business Services) has disclosed that a September 2025 cyberattack compromised the personal data of more than 1.2 million individuals. According to the company's breach notification, attackers gained unauthorized access to MCBS systems between September 22 and September 26, 2025, potentially exfiltrating files containing names, addresses, Social Security numbers, dates of birth, health insurance details, and medical records. The US Department of Health and Human Services data breach tracker confirms the incident impacts 1,261,464 individuals across seven named healthcare organizations whose billing data MCBS managed.

The PEAR ransomware group, which emerged in mid-2025, has claimed responsibility for the attack, stating it stole over 3 TB of data including company and client financials, HR documents, partner and vendor records, patient PII and PHI, payment details, and internal email archives. PEAR has since published the allegedly stolen files on its leak site, which now lists more than 100 claimed victims. The group has also been linked to the Motility Software Solutions breach affecting 766,000 people and the Tri-Century Eye Care incident impacting 200,000 individuals.

The compromised information, particularly SSNs combined with medical and insurance data, creates significant long-term identity theft and fraud risks for affected patients. Affected individuals should immediately verify whether their credentials appear in known exposures using an email breach checker and rotate any passwords reused across services, testing new ones with a password checker. Running a full privacy checkup is also recommended to identify other exposed account data and harden personal security posture against follow-on attacks.