A third-party vendor that services healthcare firms has suffered a colossal data breach, potentially exposing the sensitive personal and medical information of over a million Americans.
The breach, classified as a hacking/IT incident by the U.S. Department of Health and Human Services Office for Civil Rights, impacts 1,261,464 Americans after hackers gained access to the computer network of Medical Computer Business Services (MCBS).
The firm says it detected unauthorized access to its systems in September 2025, enabling attackers to steal data, which may include names, addresses, Social Security numbers, dates of birth, health plan beneficiary numbers, health insurance policy numbers or subscriber identification numbers and other medical records.
“Upon learning of this issue, we immediately commenced a prompt and thorough investigation. As part of our investigation, we have been working very closely with external cybersecurity professionals experienced in handling these types of incidents. After an extensive forensic investigation and comprehensive document review, we discovered on or about May 28, 2026, that certain files containing your personal information may have been subject to unauthorized acquisition between approximately September 22, 2025 and September 26, 2025.”
MCBS operates as a business associate that handles administrative, financial and backend operations for hospitals, private practices and medical groups.
The firm says it abruptly notified affected individuals while offering complimentary access to identity protection services as a precaution. For now, MCBS says it has not seen any misuse of affected individuals’ personal or health information.
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
Generated Image: Midjourney
