MedRevenu Data Breach Exposes Sensitive Healthcare and Financial Data in Ransomware Attack California-based revenue cycle management firm MedRevenu suffered a ransomware attack in December 2024, compromising sensitive data belonging to current and former patients of Inland Physicians Hospitalist Services. The breach was first detected on December 12, 2024, after a network disruption, prompting an investigation that revealed unauthorized access to files containing personally identifiable information (PII) and protected health information (PHI). The BianLian ransomware group claimed responsibility for the attack on December 14, 2024, posting details on the dark web. The threat actors asserted they had exfiltrated a broad range of data, including financial records, QuickBooks data, HR files, contracts, internal emails, databases, and medical records. A thorough electronic discovery process, completed on October 21, 2025, confirmed that exposed data varied by individual but included names, dates of birth, Social Security numbers, driver’s license numbers, health insurance details, medical records, financial account numbers, and payment card information. The breach was officially reported to the California Attorney General on February 3, 2026, though the total number of affected individuals remains undisclosed. In response, MedRevenu secured its network, engaged cybersecurity specialists, and implemented enhanced safeguards. Affected individuals were offered 12 months of complimentary credit monitoring, credit reports, and fraud alerts through TransUnion, with enrollment available within 90 days of notification. The company also provided guidance on credit freezes, fraud alerts, and identity theft reporting. The incident underscores the growing threat of ransomware attacks targeting healthcare-adjacent service providers, with sensitive patient and financial data increasingly at risk.