Healthcare billing company Medical Computer Business Services (MCBS) has disclosed that a 2025 network breach exposed the sensitive information of more than 1.2 million people.
Commenting on this is Rebecca Moody, Head of Data Research at Comparitech:
“This is another prime example of why third-party healthcare companies, like medical billing providers, have become a prime target for ransomware groups. By targeting one entity, they’re gaining access to multiple healthcare providers and their data. Our recent H1 healthcare ransomware report found a 35 percent uptick in attacks on these types of companies (those that specialize within the healthcare sector but don’t provide direct care). This breach becomes the second-largest on a third-party healthcare business following a ransomware attack in the last 18 months.”
The report that was linked is a very good one, and I encourage you to read it if you get a chance.
UPDATE: Additional commentary comes via Seemant Sehgal, Founder & CEO, BreachLock:
“A breach that ran for four days in September 2025 and surfaced in a public disclosure eight months later tells you something about how difficult incident response and forensic review are in environments that handle data across multiple providers simultaneously. The data types here, Social Security numbers, insurance details, medical information, are the combination that makes downstream fraud viable for years, which means the harm timeline for affected individuals extends well beyond the notification date. Eight months is a long time for that data to be in motion before patients knew to watch for it.”
John Strand, Owner, Black Hills Information Security, Inc.:
“One of the things I absolutely hate about stories like this is that the default response is almost always complimentary identity protection services. Yes, those services can detect some types of fraud, but they don’t come close to addressing the full range of risks created by a data breach. They have value, but they’re far from a complete solution.
“I’ve started calling this the information security equivalent of thoughts and prayers. It’s the absolute bare minimum a company can offer after a breach without making meaningful changes to improve security or reduce future risk. The reality is that only a fraction of affected people will ever enroll in those services, and even those who do aren’t protected against every way their information can be abused. It’s frustrating because organizations can suffer a major breach, offer a year of identity protection, and too often that’s treated as an adequate response instead of a starting point for real accountability.”
Damon Small, Board of Directors, Xcape, Inc.:
“Third-party healthcare billing breaches create massive regulatory exposure and systemic supply chain liability when basic detection and response controls fail. The intrusion at Medical Business Office Systems, known as MCBS, allowed attackers to dwell for days and exfiltrate over three terabytes of sensitive patient and insurance data undetected, exposing non-existent data loss prevention and egress monitoring capabilities.
“Furthermore, an eight-month delay before patient notification, justified by waiting for internal investigation completion, highlights severely flawed incident response processes. Security leaders must mandate continuous network egress monitoring, enforce strict data loss controls on revenue cycle aggregators, and require business associates to report material intrusions within days rather than waiting for post-forensic completion.
“Critical Takeaways
- Monitor large-scale data egress: Deploy continuous network monitoring and data loss prevention tools to detect abnormal outbound traffic before terabytes leave the perimeter.
- Accelerate incident response SLAs: Mandate that third-party vendors establish tight notification timelines rather than withholding breach disclosures for months while conducting internal reviews.
- Enforce vendor risk accountability: Require revenue cycle partners to submit to regular security telemetry audits and maintain strict field-level data controls for sensitive patient records.
“If it takes eight months to realize three terabytes of patient data walked out the door, your incident response plan is a post-mortem, not a defense.”
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:
“MCBS had a regulatory shortcut available that would have made this entire disclosure unnecessary. The Health Insurance Portability and Accountability Act (HIPAA) includes a breach notification safe harbor for properly encrypted data, meaning if those 1.26 million Social Security numbers had been encrypted at the field level, the stolen files would have been useless ciphertext and the breach wouldn’t have triggered notification requirements. The encryption was always the cheapest fix. MCBS chose not to implement it when the rule calls encryption “addressable” rather than mandatory.
“The Department of Health and Human Services proposed eliminating that flexibility in January 2025, making AES-256 encryption at rest mandatory for all electronic protected health information. That rule hasn’t been finalized, and final action has been pushed to July 2027. Encryption remains “addressable” today, and every healthcare billing company that reads “addressable” as “optional” is sitting on the same exposure MCBS had.
“Credit monitoring as a remedy tells you what the breach responders think the threat model is, and they’re thinking too narrowly. PEAR (Pure Extraction and Ransom) exfiltrated 3.3 terabytes from MCBS, including medical histories, mental health conditions, and diagnosis information. That data enables targeted blackmail, insurance manipulation, and employment discrimination. A credit freeze catches none of it.
“Under the EU’s General Data Protection Regulation (GDPR) Article 82, affected individuals can claim compensation directly from the company that lost their data. The US gives 1.26 million people a year of free credit monitoring instead. A $4 trillion industry can afford field-level encryption, and it can afford direct liability to patients when it skips it.”
Cyberattacks target five Minnesota water utilities
Posted in Commentary on July 28, 2026 by itnerdCyberattacks targeting the water utilities of Braham, South St. Paul, Plymouth, Maple Plain and St. Cloud, Minnesota disrupted automated control systems at multiple facilities, prompting operators to switch to manual operations.
In Braham, the attack temporarily shut down the city’s water treatment plant, but crews restored service in less than two hours, and officials said water quality, public safety and infrastructure were not affected.
Minnesota IT Services (MNIT) confirmed it is assisting the affected communities with incident response, forensic analysis, and recovery efforts. Officials said the attacks primarily targeted industrial control systems used to monitor and operate water infrastructure, and investigations into the incidents remain ongoing.
Denis Calderone, CTO, Suzu Labs:
“The reporting is early on these attacks and there is no way to definitively attribute who the threat actor is, but it’s awfully coincidental that attacks against water utility control systems in five Minnesota cities are coming this soon after CISA released advisory AA26-097A warning about exactly these kinds of targets. That advisory, updated just last week with expanded scope covering Siemens and Schneider PLCs alongside Rockwell, specifically names water and wastewater systems as a targeted sector. We can’t draw a line between the two yet, but it fits the pattern we’ve been tracking since April.
“The good news here is that every one of these cities was able to fall back to manual operations and maintain service. The fact that trained crews could step in and run these systems manually while the automated controls were compromised is what kept this from becoming a major public safety incident.
“With the little that is known about these attacks, we did find it particularly interesting that Plymouth city officials noted that the impact was limited to equipment connected via cellular communications. Water towers, lift stations, pump stations, these remote assets often connect back to the SCADA system over cellular modems, and in our experience secondary and/or alternative comm links are often overlooked when doing risk and vulnerability analysis, so it’s not too surprising then that the vector of attack may have been via these cellular connections. Oftentimes, regarding SCADA and Industrial Control networks, the infrastructure is largely built out by the integrator which increases the chance that these connections get overlooked. We saw in the reporting that Braham’s city administrator is now asking for their system vulnerability study to be reevaluated, and I wouldn’t be surprised if that study never included those cellular communication paths in the first place.
“The prescriptive advice here is the same as it’s been all year: take control systems off the internet, segment OT networks from IT, change default credentials on every device in the environment, and put remote access behind a VPN. But the lesson from Minnesota is that you have to know all the links. Every communication path into your control environment needs to be inventoried and tested, including the cellular modems, the radio links, the backup communication channels that don’t show up on the network diagram because the diagrams just don’t go into that level of depth, or because some components are simply forgotten about because they were installed five years ago by a contractor who’s long gone. If you don’t know every way into your control systems, you can’t protect them.”
Donald McFarlane, Advisory Board Member, Xcape, Inc.
“The encouraging news is that operators appear to have maintained safe water service through a mix of manual operations and resilient system design. If those facts hold, this demonstrates an important principle: cyber resilience isn’t about preventing every intrusion, it’s about ensuring cyber incidents don’t become public safety incidents. As cyber attacks increasingly target operational technology, organizations need the operational ability to find exposed systems, fix the highest-risk vulnerabilities, detect compromise when prevention fails, and contain attacks before they disrupt essential services.”
John Strand, Owner, Black Hills Information Security, Inc.:
“We’re seeing more breaches targeting public and critical infrastructure, and I think one of the biggest things people are missing is the difference between financially motivated attackers and nation-state adversaries. When a criminal group compromises a network, they’re often looking for a quick payday through ransomware or data theft. Nation-state operators frequently have a very different objective.
“Their goal is often to gain access and stay there. They want to establish persistence, quietly understand the environment, and position themselves so they can disrupt critical infrastructure whenever it serves their strategic interests. Water treatment facilities, power generation, transportation, and other essential services are attractive targets because they provide leverage long before an attack is ever launched.
“The challenge is that many security programs are still built to detect noisy attacks like ransomware or smash and grab intrusions. They’re much less effective at finding the low and slow activity that characterizes many nation-state operations. If organizations responsible for critical infrastructure aren’t investing in threat hunting, network telemetry, and behavioral analysis designed to uncover long-term persistence, there’s a real risk that sophisticated adversaries will remain inside those environments long before anyone realizes they’re there.”
Seemant Sehgal, Founder & CEO, BreachLock:
“Five separate water utilities hit across Minnesota tells you this was coordinated targeting of a sector, not opportunistic scanning that happened to find a few open doors. The reassuring headline is that crews switched to manual and restored service fast, but manual fallback is a contingency, and contingencies have limits that vary by facility, by staffing, and by how long the disruption runs. What investigators need to establish is how the same attack pattern reached systems in Braham, South St. Paul, Plymouth, Maple Plain, and St. Cloud, because whatever that common thread is, it almost certainly exists in water infrastructure well beyond Minnesota.”
You’re a target. So you have to behave that way. Beef up your defences so that you don’t end up like these organizations. Otherwise you will end up like these organizations.
Leave a comment »