MCBS Data Breach Exposes Sensitive Patient Information in Augusta, GA A network security incident at MCBS, LLC, a medical billing service provider for healthcare practices, has potentially exposed the personal and medical data of patients linked to Stephen W. Brown & Radiology Associates of Augusta. The breach was first detected on September 25, 2025, when MCBS identified unauthorized access to its systems. Following an investigation with external cybersecurity experts, MCBS determined on May 28, 2026, that sensitive files may have been accessed or acquired between September 22–26, 2025. The compromised data includes: - Full names and addresses - Social Security numbers - Dates of birth - Health plan and insurance details - Medical histories, diagnoses, and treatment records MCBS stated it has no evidence of misuse or fraud stemming from the incident but is offering 12 months of complimentary identity monitoring through Kroll as a precaution. Affected patients were notified via mail and advised to review medical statements and credit reports for suspicious activity. The breach highlights ongoing risks in third-party healthcare data handling, with MCBS emphasizing the importance of vigilance despite the lack of confirmed fraud. The incident remains under review.

MCBS LLC Discloses Data Breach Affecting Healthcare Patients MCBS LLC, a Georgia-based medical billing and business services provider founded in 1981, has reported a data breach involving unauthorized access to its network. The company, which serves small and medium-sized healthcare practices with billing, coding, and administrative support, disclosed the incident to the California Attorney General on June 26, 2026, and posted a notice on its website. The breach was first detected on September 25, 2025, prompting an investigation with external cybersecurity experts. A forensic review later revealed that unauthorized access occurred over a four-day period (September 22–26, 2025), during which files containing sensitive personal and health information may have been compromised. Since MCBS operates as a third-party vendor for healthcare providers, the affected individuals are patients of its client practices. The exposed data includes personally identifiable information (PII) and protected health information (PHI), such as names, dates of birth, addresses, Social Security numbers, medical histories, treatment details, and health insurance information. In response, MCBS is notifying impacted individuals on behalf of its healthcare clients and offering complimentary identity protection services through a third-party provider. The company has also set up a dedicated toll-free response line to assist affected individuals with questions and protective measures. Notification letters include details on enrollment, fraud alerts, credit freezes, and credit report access.

Healthcare Data Breaches Surge as Third-Party Vendors Become Prime Targets In the first half of 2026, third-party vendors known as business associates were involved in 43% of all large healthcare data breaches reported to U.S. regulators, a sharp rise from the 20% average seen between 2009 and 2017. This trend reflects the growing concentration of sensitive patient data within vendor systems, making them high-value targets for cyberattacks. June alone saw 66 major healthcare breaches, exposing the protected health information (PHI) of 4.5 million individuals. The two largest incidents both targeting business associates compromised data for over 2.6 million people. Among them: - Xsolis, a Tennessee-based AI-powered utilization management firm, suffered a phishing attack in January that granted attackers four days of network access, exposing 1.4 million records. - MCBS, a Georgia-based billing and revenue cycle management company, fell victim to the PEAR extortion group, which stole files containing Social Security numbers, medical histories, and insurance details for 1.25 million individuals. These breaches highlight a critical shift: vendor-side incidents now dominate healthcare data exposure, surpassing traditional breaches at hospitals or health plans. Under HIPAA, covered entities (such as employers with group health plans) remain liable if they fail to ensure vendors comply with security requirements even if the breach occurs at the vendor level. The Spencer Gifts LLC case underscored this risk. In June, the HHS Office for Civil Rights (OCR) settled a $450,000 HIPAA violation fine with the retailer’s benefits plan after a 2021 ransomware attack exposed data for 10,023 members. Investigators found the plan had no risk analysis or HIPAA-compliant policies in place. The enforcement action marked OCR’s 20th ransomware-related settlement and served as a warning to employers that group health plans regardless of industry must adhere to HIPAA Security Rule requirements. The year-to-date breach victim count through June reached 34 million, a decline from 2024 and 2025, though still elevated compared to historical averages. However, hacking accounted for 89.7% of affected individuals in June, reinforcing the need for continuous vendor security assessments rather than one-time compliance checks. As healthcare data becomes increasingly centralized in third-party systems, the cascading impact of vendor breaches grows affecting not just the compromised company but every covered entity in its client network. The trend shows no signs of slowing, with business associate involvement in breaches nearly doubling over the past decade.