Catalyst RCM Data Breach Exposes Sensitive Patient Information in Ransomware Attack Catalyst RCM, a U.S.-based revenue cycle management provider for healthcare organizations, confirmed a data breach after detecting suspicious activity in its file management system on November 13, 2025. An investigation revealed that unauthorized access occurred between November 8–9, 2025, when an attacker used valid credentials to copy data from a server. The Everest ransomware group claimed responsibility for the attack, announcing on a dark web forum that it had exfiltrated 9.39 GB of data from Vikor Scientific (now Vanta Diagnostics), including medical billing documents tied to KorPath and Korgene diagnostic laboratories. The stolen records contained sensitive patient information, such as: - Names and contact details - Dates of birth - Health insurance data - Provider names and internal patient IDs - Dates of service, medications, and treatment details While the total number of affected individuals remains undisclosed, 88 Rhode Island residents were confirmed impacted. Catalyst RCM posted a breach notice on its website, with Vikor Scientific linking to the disclosure. The incident was reported to the attorneys general offices of California and Vermont. The company completed its review on December 12, 2025, and is offering affected individuals complimentary identity protection services, including credit monitoring, cyber scan monitoring, and a $1 million insurance reimbursement policy. Legal firms, including Shamis & Gentile P.A., are investigating potential compensation claims for victims.