MCBS mcbsllc.com MCBS data breach: what happened and what to do
Medical billing firm MCBS reported a September 2025 breach affecting 1,261,464 people, per HHS. Exposed data includes names, Social Security numbers, health insurance details and medical information.
View all 13,115 breaches- Breach date
- 22 Sept 2025
- Affected
- 1,261,464
- Data exposed
- Names, Physical addresses, Social security numbers, Dates of birth, Health insurance information, Medical information, Treatment information
- Last updated
What happened
MCBS, a medical billing and practice-management company based in Augusta, Georgia, reported to the U.S. Department of Health and Human Services (HHS) that a hacking incident affected 1,261,464 people. The intrusion ran from September 22 to 26, 2025, and the company noticed unauthorized access around September 25.
MCBS says it didn't confirm which files were affected until May 28, 2026, so notification letters went out months after the attack. Reporting says patients of at least seven healthcare providers were involved, including South Georgia Radiology Consultants, SkinPath Solutions and Radiology Associates. You may have heard of the breach from your doctor's office rather than from MCBS, because billing firms work on behalf of providers.
The data varies by person. Reporting on the notice lists names, addresses, Social Security numbers, dates of birth, health plan and insurance identification numbers, and medical history, diagnosis and treatment information. MCBS hasn't named the attacker.
Medical information is a different sort of exposure from a password. A health insurance number can be used for medical identity theft, such as billing care in your name, and a Social Security number with a birth date opens credit fraud. Details about treatment also give scammers material for believable calls from "your provider" or "your insurer". Those risks last for years, so the steps below focus on locking down credit and reading your insurance paperwork.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion is free and blocks new credit in your name. Do it if you received a letter, since Social Security numbers were involved.
- 2
Read your insurance statements
Check every explanation of benefits for services you didn't receive. Report anything unfamiliar to your insurer and ask for a new member ID if it's offered.
- 3
Use the monitoring offered in your letter
If your notice includes credit monitoring or identity protection, enroll before the deadline in the letter.
- 4
Be skeptical of calls about your care
Scammers may quote real treatment details. Hang up and call your provider or insurer on the number printed on your card.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web for your email, phone number and passwords, and alerts you when they show up. You can run a free scan at serus.ai. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the MCBS breach?
If you got a notice letter from MCBS or your provider, yes. HHS lists 1,261,464 people in total. Letters came through providers that used MCBS for billing.
What was exposed?
Reporting on the notice lists names, addresses, Social Security numbers, dates of birth, health insurance numbers, and medical history, diagnosis and treatment information. It varies by person.
Is there a settlement?
No settlement has been reported.
Should I change my password?
The notice doesn't mention passwords. Freezing your credit and watching your insurance statements matter more here.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- oag.ca.gov/privacy/databreach/list
- bleepingcomputer.com/news/security/data-breach-at-medical-billing-firm-mcbs-affects-126-million-people
- beckershospitalreview.com/healthcare-information-technology/cybersecurity/rcm-vendor-data-breach-affects-1-2-million-patients
Something wrong or out of date? Tell us and we'll re-check it.
