MCBS data breach: a medical billing company's files possibly taken in September 2025

What happened in the MCBS data breach?

MCBS says it obtained recipients' information from a covered entity, the provider it bills for, to provide medical billing services. It says it began an investigation with outside cybersecurity professionals when it learned of the possible access, and that the forensic investigation and document review took until late May 2026.

Date	What the letter and the regulators' records say
September 22 to 26, 2025	Files may have been taken; breach dates on California's record
On or about September 25, 2025	MCBS learns of possible network access
On or about May 28, 2026	Document review finds personal information in the files
June 26, 2026	Report submitted to HHS; notice recorded by California; report logged in Massachusetts
June 30, 2026	Posted on the Texas attorney general's list

274 days passed between MCBS learning of the possible access and the first regulator records, and 29 days between the document review's finding and those records. The notice delay study compares such gaps.

What information was involved?

The redacted letter filed with California leaves the information list and the name of the provider blank. Texas lists names, addresses, Social Security numbers, medical and health insurance information and dates of birth; Massachusetts marks Social Security numbers and medical records as breached, and financial accounts, driver's licenses and payment cards as not breached.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected	1,261,464
Texas attorney general	Texans	13,302
Massachusetts consumer affairs office	Massachusetts residents	383

It is the 15th largest 2026 report among the open cases on the federal list.

What is MCBS offering people who got a letter?

The filed letter mentions complimentary identity protection services but leaves the provider, the length and the response line's number and hours blank, so each recipient's letter carries its own terms. It also points readers to the Federal Trade Commission's guidance on medical identity theft.

Why did I get a letter from MCBS?

A doctor, clinic or hospital you used sends its medical billing to MCBS. The letter is written on that provider's behalf. The guide to letters from companies you never dealt with explains the chain.

What the documents leave open

• How the unauthorized individual got in.
• Which providers' patients are affected.
• What MCBS is offering, since the filed copy is redacted.