MCBS Data Breach Linked to PEAR Ransomware Confirmed at 1.2 Million Patients

A data breach at MCBS, a medical billing and revenue cycle management company based in Augusta, Georgia, now affects more than 1.2 million patients, according to the breach tracker maintained by the U.S. Department of Health and Human Services (HHS). SecurityWeek reported the updated federal total on July 27, 2026, months after MCBS’s earliest state-level filings pointed to a far smaller number.

What MCBS Says Happened

MCBS says it learned of the intrusion on or about September 25, 2025, and that unauthorized access to its network occurred between September 22 and September 26, 2025. According to the company’s own breach notification, it took until May 28, 2026, roughly eight months later, for an investigation to determine that files containing patients’ personal information had actually been accessed.

The exposed data varies by individual but can include names, addresses, Social Security numbers, dates of birth, health insurance policy and subscriber numbers, health plan beneficiary numbers, medical history, diagnosis information, and details about mental or physical conditions and medical treatment.

MCBS provides billing and revenue cycle services to healthcare providers rather than treating patients directly, so the breach exposed data belonging to its clients as well as MCBS itself. The company’s notification names seven healthcare organizations whose patient data was involved: C&C MD PC, Nuclear Medicine and Pathology Associates, Radiation Oncology Associates LLP, SkinPath Solutions LLC, South Georgia Radiology Consultants PC, Stephen W. Brown & Radiology Associates of Augusta LLP, and Vascular Radiology Associates II LLP, mostly specialty medical practices in the Augusta area.

PEAR’s Healthcare-Focused Extortion Campaign

The PEAR ransomware group claimed credit for the MCBS attack on September 30, 2025, saying it had stolen more than 3 TB of data. Per SecurityWeek’s reporting on the claim, the haul allegedly spans internal financials for MCBS and its clients, HR and operations records, vendor data, patient PII and PHI, payment details, and email correspondence. The group has since made the files available for download on its leak site.

PEAR emerged in mid-2025 and has concentrated heavily on healthcare targets. SecurityWeek reports the group’s leak site currently lists more than 100 alleged victims, and that PEAR has previously claimed responsibility for breaches at Motility Software Solutions, which affected 766,000 people, and Tri-Century Eye Care, which affected 200,000 people. Among the healthcare breaches SecurityWeek has tied to PEAR, the MCBS incident is by far the largest.

A Patient Count That Kept Climbing

MCBS’s disclosure did not arrive with a single final number. Security research site Comparitech reported an earlier tally based on state-by-state filings: roughly 309,000 people combined across South Carolina, Texas, and Massachusetts alone. Comparitech’s count explicitly excluded Georgia residents and noted the total was expected to rise.

That is exactly what happened. The HHS breach portal, the federal system that publishes large HIPAA breaches, now lists the MCBS incident at 1,261,464 individuals, more than four times that earlier state-filing total. The gap illustrates a recurring pattern in large healthcare breaches: state attorneys general often receive notifications on a rolling basis as an investigation and mailing process continues, while a consolidated national figure only becomes visible once a company finishes notifying every affected state and the HHS portal is updated to match.

What MCBS Is Telling Affected Patients

MCBS’s notification recommends that affected individuals place fraud alerts and security freezes with the major credit bureaus and pursue free credit monitoring. The notification does not name a specific credit monitoring service being provided to affected patients, so anyone who receives a letter should read it carefully rather than assume monitoring is automatically in place.

For healthcare providers, the incident is a reminder that a breach at a single billing or revenue cycle vendor can expose patient data across many unrelated practices at once. None of the seven organizations named in the MCBS notification had a direct role in securing MCBS’s own network, yet their patients are now dealing with exposed Social Security numbers and medical records because of it. Healthcare data remains a favored target for ransomware and extortion groups precisely because medical histories and insurance identifiers cannot be reissued the way a password or credit card number can.