Professional Finance Company data breach: what happened and what to do

Professional Finance Company, a medical debt collector, reported a ransomware attack in February 2022 that affected 1,918,941 people. Names, addresses, birthdates, Social Security numbers, and financial and health insurance details were involved.

View all 13,177 breaches

Breach date: 22 Feb 2022
Affected: 1,918,941
Data exposed: Names, Physical addresses, Dates of birth, Social security numbers, Bank account numbers, Health insurance information
Last updated: 30 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Professional Finance Company (PFC) collects unpaid medical bills for hospitals and clinics. It reported a ransomware attack that began in February 2022. The company says it detected and blocked the attack on February 26, 2022, but not before some of its systems were disabled.

PFC reported the incident to the U.S. Department of Health and Human Services as affecting 1,918,941 people. Because PFC works for healthcare providers, the breach reached people who never dealt with PFC directly: they owed a bill to one of its more than 650 healthcare clients. Several of those providers sent their own notices to patients.

Sources checked: consumer.ftc.gov, identitytheft.gov, hipaajournal.com

Last verified against the official page: 30 Oct 2026

How we research this Report an error

What was exposed

HHS lists names, addresses, birthdates, Social Security numbers, and financial and health insurance information. A Social Security number plus a birthdate is what criminals need to open credit in someone else's name, so identity theft is the main risk. A name, address and insurer can also make a phishing call or letter about a "medical bill" sound convincing.

The company's response

PFC told HHS it added administrative, technical and security safeguards after the attack. A class action over the breach was later settled; PFC denied wrongdoing.

What to do if you were in it

1

Freeze your credit at all three bureaus

A credit freeze is free and stops new accounts being opened in your name. Place one with Equifax, Experian and TransUnion, as the FTC explains in its guide to credit freezes and fraud alerts. You can lift it when you need to apply for credit.
2

Watch your statements and credit reports

Check your bank, card and insurance statements for anything you don't recognize. You can get free credit reports from the three bureaus at AnnualCreditReport.com.
3

Be wary of medical bill messages

Debt collection and billing messages that mention a real provider may be scams. Contact the provider or insurer using a number from your own statement, not the one in the message.
4

Report misuse at IdentityTheft.gov

If someone opens an account or files a return in your name, report it at IdentityTheft.gov. The FTC builds a recovery plan with the steps and letters you need.
5

Check whether your email or phone is in this and other breaches

Run a free Serus scan to see if your email address or phone number shows up in known breaches. Serus can't remove breach data, but it alerts you and tells you what to do.

Official filings

U.S. Department of Health and Human Services , filed 1 Jul 2022 : 1,918,941 people

Timeline

22 Feb 2022
The breach happened
1 Jul 2022
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Professional Finance Company breach?

The company or one of the healthcare providers it worked for should have sent a notice. If you owed a medical bill that went to collections around 2022, check your mail and ask the provider.

What was exposed?

HHS lists names, addresses, birthdates, Social Security numbers, and financial and health insurance information.

Should I freeze my credit?

If your Social Security number was involved, the FTC recommends considering a credit freeze. It is free at Equifax, Experian and TransUnion.