The IT Nerd

Healthcare billing company Medical Computer Business Services (MCBS) has disclosed that a 2025 network breach exposed the sensitive information of more than 1.2 million people.

Commenting on this is Rebecca Moody, Head of Data Research at Comparitech: 

“This is another prime example of why third-party healthcare companies, like medical billing providers, have become a prime target for ransomware groups. By targeting one entity, they’re gaining access to multiple healthcare providers and their data. Our recent H1 healthcare ransomware report found a 35 percent uptick in attacks on these types of companies (those that specialize within the healthcare sector but don’t provide direct care). This breach becomes the second-largest on a third-party healthcare business following a ransomware attack in the last 18 months.”

The report that was linked is a very good one, and I encourage you to read it if you get a chance.

UPDATE: Additional commentary comes via Seemant Sehgal, Founder & CEO, BreachLock:

   “A breach that ran for four days in September 2025 and surfaced in a public disclosure eight months later tells you something about how difficult incident response and forensic review are in environments that handle data across multiple providers simultaneously. The data types here, Social Security numbers, insurance details, medical information, are the combination that makes downstream fraud viable for years, which means the harm timeline for affected individuals extends well beyond the notification date. Eight months is a long time for that data to be in motion before patients knew to watch for it.”

John Strand, Owner, Black Hills Information Security, Inc.:

   “One of the things I absolutely hate about stories like this is that the default response is almost always complimentary identity protection services. Yes, those services can detect some types of fraud, but they don’t come close to addressing the full range of risks created by a data breach. They have value, but they’re far from a complete solution.

   “I’ve started calling this the information security equivalent of thoughts and prayers. It’s the absolute bare minimum a company can offer after a breach without making meaningful changes to improve security or reduce future risk. The reality is that only a fraction of affected people will ever enroll in those services, and even those who do aren’t protected against every way their information can be abused. It’s frustrating because organizations can suffer a major breach, offer a year of identity protection, and too often that’s treated as an adequate response instead of a starting point for real accountability.”

Damon Small, Board of Directors, Xcape, Inc.:

   “Third-party healthcare billing breaches create massive regulatory exposure and systemic supply chain liability when basic detection and response controls fail. The intrusion at Medical Business Office Systems, known as MCBS, allowed attackers to dwell for days and exfiltrate over three terabytes of sensitive patient and insurance data undetected, exposing non-existent data loss prevention and egress monitoring capabilities.

   “Furthermore, an eight-month delay before patient notification, justified by waiting for internal investigation completion, highlights severely flawed incident response processes. Security leaders must mandate continuous network egress monitoring, enforce strict data loss controls on revenue cycle aggregators, and require business associates to report material intrusions within days rather than waiting for post-forensic completion.

   “Critical Takeaways

• Monitor large-scale data egress: Deploy continuous network monitoring and data loss prevention tools to detect abnormal outbound traffic before terabytes leave the perimeter.
• Accelerate incident response SLAs: Mandate that third-party vendors establish tight notification timelines rather than withholding breach disclosures for months while conducting internal reviews.
• Enforce vendor risk accountability: Require revenue cycle partners to submit to regular security telemetry audits and maintain strict field-level data controls for sensitive patient records.

   “If it takes eight months to realize three terabytes of patient data walked out the door, your incident response plan is a post-mortem, not a defense.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

   “MCBS had a regulatory shortcut available that would have made this entire disclosure unnecessary. The Health Insurance Portability and Accountability Act (HIPAA) includes a breach notification safe harbor for properly encrypted data, meaning if those 1.26 million Social Security numbers had been encrypted at the field level, the stolen files would have been useless ciphertext and the breach wouldn’t have triggered notification requirements. The encryption was always the cheapest fix. MCBS chose not to implement it when the rule calls encryption “addressable” rather than mandatory.

   “The Department of Health and Human Services proposed eliminating that flexibility in January 2025, making AES-256 encryption at rest mandatory for all electronic protected health information. That rule hasn’t been finalized, and final action has been pushed to July 2027. Encryption remains “addressable” today, and every healthcare billing company that reads “addressable” as “optional” is sitting on the same exposure MCBS had.

   “Credit monitoring as a remedy tells you what the breach responders think the threat model is, and they’re thinking too narrowly. PEAR (Pure Extraction and Ransom) exfiltrated 3.3 terabytes from MCBS, including medical histories, mental health conditions, and diagnosis information. That data enables targeted blackmail, insurance manipulation, and employment discrimination. A credit freeze catches none of it.

   “Under the EU’s General Data Protection Regulation (GDPR) Article 82, affected individuals can claim compensation directly from the company that lost their data. The US gives 1.26 million people a year of free credit monitoring instead. A $4 trillion industry can afford field-level encryption, and it can afford direct liability to patients when it skips it.”

The dental benefits administrator DentaQuest has started issuing notification letters to individuals affected by a May 2026 cybersecurity incident. The number of affected individuals has yet to be confirmed, although DentaQuest has confirmed that at least 15 million individuals have been affected.

Commenting on this is Paul Bischoff, Consumer Privacy Advocate at Comparitech: 

“This is a major data breach both in terms of the number of people affected and the types of personal information involved. DentaQuest customers should take advantage of free credit monitoring offered by DentaQuest and monitor their credit reports, bank accounts, and medical bills for unrecognized activity. Whether or not DentaQuest paid ShinyHunters’ ransom demand, there is no guarantee that the group will delete the stolen data. Breach victims should assume the worst and act accordingly to protect their accounts and identities.”

Comparitech recently published an in-depth research study looking at ransomware attacks against healthcare institutions in the first half of 2026, finding that attacks increased nearly 14% since the last half of 2025. 

Comparitech has published a new study looking at ransomware attacks against the education sector in H1 2026, finding that while overall attacks against educational institutions declined, attacks on higher education actually increased. 

Key findings include: 

• 104 attacks in total
• 36 confirmed attacks
• 68 unconfirmed attacks
• Nearly 693,000 records are known to have been breached in the confirmed attacks
• Median ransom demand: $420,620 – up 53% from $275,000 in H2 2025
• The ransomware strains that made the most attack claims were The Gentlemen and Qilin (15 each), LockBit (9), Interlock and Nova (6 each)
• The Gentlemen claimed the most confirmed attacks (6), followed by Interlock (4) and Qilin and LockBit (3 each)

For full details, the research can be read here: https://www.comparitech.com/news/education-ransomware-roundup-h1-2026-stats-on-attacks-ransoms-and-data-breaches/ 

Comparitech researchers have published a new study looking at ransomware attacks targeting the government sector in H1 2026. 

According to the findings, Comparitech researchers logged an average of one ransomware attack on a government entity every day. Attacks jumped by over 13 percent when compared to H2 2025, increasing from 165 to 187 attacks. 

Rebecca Moody, Head of Data Research at Comparitech, provided the following comment: 

“Predicting what’s going to happen within the ransomware threat landscape for the rest of the year is always difficult. However, based on our H1 2026 data and the increased momentum of The Gentlemen, ransomware attacks within the government sector remain a dominant, if not growing, threat. From weeks-long disruptions due to system encryption to extensive data breaches, governments are the ideal target for hackers.

The ongoing attack on Latvia’s state forestry company (LVM) should also serve as a reminder that government agencies have to ensure they’re meeting the basic cybersecurity best practices. In LVM’s case, hackers were able to exploit a vulnerability in a system that hadn’t been updated in two years. Keeping systems up to date, patching vulnerabilities as soon as they’re flagged, carrying out regular backups, and making sure employees are regularly trained and are on high alert at all times are crucial to mitigating the risks of attacks.”

You can read the details here: https://www.comparitech.com/news/government-ransomware-roundup-h1-2026-stats-on-attacks-ransoms-and-data-breaches/

Comparitech researchers have published a new study looking at ransomware attacks against the healthcare sector in H1 2026. 

According to the findings, during the first six months of 2026, the healthcare sector suffered an average of 2.3 ransomware attacks per day. Attacks increased by nearly 14 percent when compared to H2 2025, rising from 360 to 410.

Rebecca Moody, Head of Data Research at Comparitech, provided the following comment: 

“As ransomware attacks remain at a consistently high level, the healthcare sector is no exception. Here, attacks continue to increase, particularly among healthcare businesses (e.g. pharmaceutical manufacturers, drug wholesalers, and medical billing providers). This means healthcare providers (those offering direct care) continue to face the threat of attacks within their own systems and within the systems of the third parties they entrust to carry out various services. 

The March 2026 attack on the University of Mississippi Medical Center, which caused two weeks of disruptions, serves as a stark reminder of the devastating impact system encryption can have on healthcare providers. Meanwhile, attacks on third parties, like Unimed in Germany, demonstrate the far-reaching consequences of data theft following these attacks. In Unimed’s case, numerous clinics and hospitals were impacted, with the breach figure growing into the hundreds of thousands.”

You can read the research here: https://www.comparitech.com/news/healthcare-ransomware-roundup-h1-2026-stats-on-attacks-ransoms-and-data-breaches/

Acording to a newly published Comparitech report, global ransomware attacks reached a new high in H1 of 2026 with an average of 23 attacks per day. During the first six months of 2026, researchers logged 4,217 ransomware attacks. This is an 11 percent increase on the second half of 2025 (3,809).

Additional key findings include: 

• 484 confirmed ransomware attacks
  • 319 were on businesses
  • 83 were on government entities
  • 49 were on healthcare companies
  • 33 were on educational institutions
• 3,733 unconfirmed attacks*
  • 3,356 were on businesses
  • 102 were on government entities
  • 198 were on healthcare companies
  • 71 were on educational institutions
• 5,019,204 records compromised in the confirmed attacks
• Median ransom demand: $150,000 (average: $1.36M)
• Qilin was the most prolific ransomware group with 641 victims in total, followed by The Gentlemen (464) and Akira (317)
• Qilin (54) and The Gentlemen (51) had the most confirmed attacks
• The United States was the most targeted country with 1,832 attacks in total, followed by Canada (200), Germany (164), the United Kingdom (157), Italy (131), France (117), and Spain (100)
• China saw one of the biggest upticks in attacks from H2 2025 to H1 2026 (up 540% from 5 to 30)

Commenting on these findings is Rebecca Moody, Head of Data Research at Comparitech: 

“One thing that stands out in this report is how the growth of one ransomware group can start to change the threat landscape. The Gentlemen overtook Qilin in the number of attack claims last month, and, as the group operates a more “international” approach to its targets, attack figures dropped in the US (when compared to H2 of 2025), despite figures increasing in most other countries. 

Around half of Qilin’s targets tend to be US-based, but less than 1 in 5 of The Gentlemen’s victims in June 2026 were based in the US. Perhaps seeing how saturated ransomware attacks are in the US, The Gentlemen has decided to focus more of its efforts further afield — and with relative success. 51 of its 2026 victims have confirmed their attacks to date, with notable names including Mackay Sugar in Australia, the Grand Hotel Taipei in Taiwan, and NATO contractor Indra (Spanish HQ but subsidiary affected).”

For full details, you can read the study here: https://www.comparitech.com/news/ransomware-roundup-h1-2026-stats-on-attacks-ransoms-and-active-gangs/

Every day, cybercriminals send around 3.4 billion phishing emails. 90 percent of successful cyber attacks originate from one of these emails. 96 percent of IT security and decision makers expect to see email security challenges throughout 2026, so you’d be forgiven for thinking that most organizations would be meeting the basics. However, Comparitech’s findings found that more than eight percent of organizations’ domains are fully unprotected. 

This Wednesday, Comparitech researchers will be publishing a new study looking into this very subject by analyszing the live DNS records for 5,849 domains across 13 sectors, scoring each based on a series of frameworks. 

Key findings include: 

• 487 of the total domains scanned (5,849) had zero protection (8.3%)
• Government domains had the lowest average score – 2.73
• Tech company domains had the highest average score – 4.83
• China had the lowest average score – 2.3

Additionally, Rebecca Moody, Head of Data Research at Comparitech, provided the following comment on the subject: 

“If you asked people which industries they’d like to assume are meeting basic cybersecurity standards, government agencies and healthcare providers would likely be among some of the most popular answers. Our study highlights that, when it comes to standard email security, this couldn’t be further from the truth. 

The fact that over 1 in 4 government agencies and 1 in 5 healthcare providers have zero email protection is incredibly concerning, particularly when the factors we’ve assessed (SPF, DMARC, DKIM, or MTA-STS) are what many would call “standard” protocols. Equally, these sectors are often subject to more regulation, demonstrating that even when they should be meeting these requirements by law, they often aren’t.

One of the biggest risks of having gaps in email security is spoofing. Without the necessary protocols in place, hackers can spoof an organization’s domain, which adds to the legitimacy of their campaign. They could use this to send phishing emails, malware, or carry out a wire fraud scam, for example. Ultimately, the email security protocols we’ve assessed shouldn’t be seen as a recommendation or “good to have,” they should be viewed as being essential for all organizations.”

You can read the research here: https://www.comparitech.com/news/which-industry-country-has-the-worst-email-security-an-analysis-of-5800-domains-for-spf-dmarc-dkim-mta-sts-protocols/

Comparitech is reporting that the city of Middletown, Ohio today confirmed it notified 123,791 people of a July 2025 data breach that compromised names, SSNs, financial account info, medical info, health insurance info, addresses, and government-issued IDs. 

The cyberattack disrupted city services including water utility billing, which wasn’t fully restored until months later in January 2026.

Commenting on this news is Rebecca Moody, Head of Data Research at Comparitech: 

“This attack highlights why government agencies remain a key target for hackers.

First, the case shows just how disruptive these attacks can be, with Middletown only being able to restore its water billing system in January of this year, around six months after the attack took place. Second, governments are often in possession of vast quantities of data. Accessing such data not only gives hackers further leverage to demand a ransom, but it also gives them key data that they can sell on the dark web if negotiations fail. The fact that SafePay posted the City of Middletown to its data leak site suggests ransom negotiations failed (for the data theft at least). 

While government agencies are sometimes prevented from paying ransoms (or have to meet strict conditions in order to pay one, as is the case in Ohio), we saw a case just last month (Murray County in Georgia) where the ransom was paid in order to prevent county data from being published. 

It’s win-win for hackers. Receive a ransom demand to decrypt systems and/or delete data, or sell highly sensitive personal data on the dark web.”

I guess hackers are about to have a field day because they seriously hit the jackpot here. Which illustrates why stopping the bad guys from doing evil things is preferable to getting pwned.

Comparitech researchers published a new study looking at all tracked ransomware attacks in the month of May 2026. According to the findings, attacks increased by just over three percent since April, but remained relatively low compared to the previous months of the year. 

Interestingly, it was found that attacks on the education sector increased significantly from April (up by 54%), while helathcare providers and utilities companies saw the largest decline in attacks (down 21% and 29% respectively).

Key findings for May 2026 include: 

• 661 attacks in total — 48 confirmed attacks (confirmed by the entity involved)
• The most prolific ransomware gangs were Qilin (97), The Gentlemen (71), and DragonForce (51)
• Qilin had the most confirmed attacks (9), followed by The Gentlemen (4) and INC (3)
• Nearly 115 TB of data was stolen across all of these attacks
• The US saw the most attacks (272), followed by Canada (31), the United Kingdom (28), and Germany (26)

Additionally, Rebecca Moody, Head of Data Research at Comparitech, commented: 

“While we should take some comfort in the fact that attack figures remained low(er) again in May, it’s important to remember that these figures are still incredibly high, particularly when compared to previous years. Furthermore, this slight reprieve isn’t being witnessed across all sectors and illustrates how hackers are often targeting specific sectors at certain times. For example, May saw a spike in the number of attacks being carried out in the education sector. This may not be a coincidence. As schools and teachers look forward to the holidays, hackers likely see this as a great opportunity to worm their way in while everyone’s starting to unwind and maybe isn’t as focused as usual.”

For full details, including a breakdown of most prolific ransomware gangs, the countries most targeted, and some of the most stand-out ransomware attacks of the month, the research can be read here: https://www.comparitech.com/news/ransomware-roundup-may-2026/

Britain has become one of the most watched nations on Earth. According to a 2021 British Security Industry Association report, approximately 21 million CCTV cameras now operate across the country,  yet what’s far less understood is the dramatic variation in who’s watching whom, and with what technology.

To find out, Comparitech filed Freedom of Information requests with all 380 UK councils and 48 police forces, mapping exactly which parts of the country are under the heaviest surveillance. The research doesn’t stop at camera counts as it reveals which councils and forces have quietly adopted facial recognition technology (FRT) and automatic number plate recognition (ANPR)  and benchmarks UK surveillance levels against major cities around the world.

Key findings include:

• Britain is home to seven of the world’s 20 most surveilled places, putting UK towns and cities in the same league as authoritarian regimes
• A single London police force operates 31,000+ cameras, a surveillance network bigger than some entire countries
• One East London council alone has over 3,000 cameras making it the highest of any council in the UK
• A Northern England council has quietly built the UK’s biggest facial recognition network with 120 cameras that can scan and identify faces in real time
• One UK police force monitors residents at a rate of nearly 49 cameras per 1,000 people
• Council camera coverage peaks in one UK country, reaching 3.6 cameras per 1,000 people

Additionally, Rebecca Moody, Head of Data Research at Comparitech has provided her insights on the findings:

“The report highlights a clear imbalance in the levels of surveillance across the UK. While some councils have opted for widespread camera systems, others have steered clear — and, as we found, this has little (if anything) to do with crime rates.

From a privacy perspective, what’s also concerning is the use of real-time systems, such as ANPR and facial recognition. While they’re in place for certain tasks, e.g. to monitor cars for traffic violations and to seek out persons of interest, they ultimately subject all citizens to mass surveillance. And, as we note, there’s also a worrying risk of “mission creep”, whereby these systems are promoted as helping X but, after a while, they’re also used to combat Y, and then Z, until, before we know it, their use is extensive and widespread. Essentially, once a system is installed under the guise of combating a certain crime, it can be easily rolled out into other areas. For example, ANPR was introduced as an anti-terrorism tool but has quickly become a key system to help with traffic enforcement.”

You can find more here: https://www.comparitech.com/news/watching-you-funded-by-you-number-of-cctv-cameras-by-uk-council-police-force/