Vikor Scientific data breach: billing vendor Catalyst RCM's server copied, 139,964 people

What happened at Catalyst RCM?

Catalyst says it learned of suspicious activity in its secure file management system on or about November 13, 2025. Its investigation found that someone used an authorized login and password to get into one server and copy data. It then reviewed the data to learn what was sensitive and whose it was, found current addresses, and finished on December 12, 2025.

Date	What happened	Source
November 8 to 9, 2025	One server accessed with a valid login; data copied	Catalyst letter; Oregon list
On or about November 13, 2025	Catalyst finds suspicious activity	Catalyst letter
December 12, 2025	Review of the data finished	Catalyst letter; Oregon list
February 6, 2026	Letters dated; notice to California and Oregon	Catalyst letter; Oregon list
May 6, 2026	IDX enrollment deadline	Catalyst letter

Letters went out 90 days after the server was copied and 56 days after the review ended. The notice-delay guide shows how that compares.

Why did Catalyst RCM have my data?

Catalyst did the coding and billing for three labs. The HIPAA Journal describes Vikor Scientific as a molecular diagnostics company in Charleston, South Carolina, now renamed Vanta Diagnostics, and KorPath as a Tampa pathology lab. If a doctor sent a sample to one of these labs, its billing records may have been in the files. The guide to why you got a breach letter from a company you never dealt with explains vendor notices like this one.

What information was exposed?

The files were mostly explanation-of-benefits letters, which carry the patient's name and the other items printed in each person's letter. The filed sample leaves those items blank. Check your own letter for the exact list.

Was it ransomware?

The letter does not say so. The HIPAA Journal reported on February 23, 2026 that the Everest ransomware group claimed the attack, listed Vikor Scientific on its leak site with sample data, and later claimed to have published everything it took. None of this appears in the notice.

What is being offered?

IDX identity protection for 12 or 24 months, depending on the letter, with credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy and identity theft recovery. The enrollment deadline was May 6, 2026, so the code no longer works. Questions go to 1-844-908-2066, 9 a.m. to 9 p.m. Eastern Time. The letter also asks recipients to review their explanation-of-benefits statements. The guide to credit monitoring offers covers the rest.

How many people were affected?

139,964, per Oregon's list. The HIPAA Journal reports the same number on the HHS breach portal under Vikor Scientific. The ranking of 2026 healthcare breaches reported to HHS lists this year's largest.

Washington's attorney general lists a notice from Vikor Scientific, LLC (Korgene, Korpath, Catalyst RCM) reported on February 6, 2026, with 1,456 Washingtonians affected. Its record names names, financial and banking information, full dates of birth, health insurance policy or ID numbers and medical information as the information compromised. The Washington ranking compares 2026's notices. The figure counts Washington residents only.

What the record leaves open

• Whose login was used, and how it was obtained.
• How many of the 139,964 are KorPath or KorGene patients.
• Whether Catalyst's other clients were affected.