Almeida Law Group is investigating a data breach at MCBS, LLC. The breach occurred on September 22nd, 2025 and was discovered on an unspecified date. If you were affected, contact Almeida Law Group.
About MCBS, LLC
MCBS, LLC (Medical Computer Business Services) is a medical billing and practice management company founded in 1981 and headquartered at 1125 Troupe Street in Augusta, Georgia. The company provides billing, coding, practice management, compliance, accounts receivable, and administrative support services to healthcare providers, acting as a HIPAA business associate on behalf of covered entity clients. Because MCBS handles medical and personal information on behalf of healthcare providers, a breach of its systems can affect patients who never interacted directly with MCBS itself.
What Happened?
MCBS, LLC was listed in a California Attorney General sample breach notice reported on June 26th, 2026. According to the breach notice, MCBS learned on or about September 25th, 2025 that an unauthorized individual may have gained access to its network. MCBS states that the unauthorized access occurred between approximately September 22nd, 2025 and September 26th, 2025. After an extensive forensic investigation and document review, MCBS says it did not determine until approximately May 28th, 2026 — more than eight months after the incident — that files containing personal information may have been subject to unauthorized acquisition. The specific data types affected are redacted in the notice, but the notice references both personal information and health information, and advises recipients to review medical records and Explanation of Benefits statements for signs of medical identity theft. The notice also offered complimentary identity protection services, though the provider name, duration, and enrollment deadline are redacted.
The PEAR (Pure Extraction And Ransom) ransomware group claimed responsibility for the attack and listed MCBS on its data leak site by approximately September 30th, 2025 — meaning the breach was publicly attributed to a ransomware actor nearly nine months before affected individuals received formal notification. Threat intelligence sources report that PEAR claimed to have exfiltrated approximately 3.3 terabytes of data. At least two proposed federal class action lawsuits followed: Neff v. McBs LLC (Case No. 1:25-cv-00235, filed around October 9th, 2025) and McCollum v. McBs LLC (Case No. 1:25-cv-00240, filed around October 14th, 2025), both alleging negligent cybersecurity practices led to the exposure of sensitive patient data including medical records and personal information. MCBS has moved to dismiss the class actions, arguing that plaintiffs have not demonstrated sufficient harm.
Key Facts at a Glance
- Company or Organization: MCBS, LLC (Medical Computer Business Services)
- Industry: Healthcare Business Services / Medical Billing
- Location: Augusta, Georgia
- Incident type: Ransomware attack with unauthorized data access and alleged exfiltration
- Date of breach: September 22nd, 2025
- Date breach discovered: September 25th, 2025
- Date of consumer notification: May 28th, 2026 (determination date); California AG notice reported June 26th, 2026
- Identity theft protection offered: Yes (provider name and duration redacted in notice)
- Litigation status: At least two proposed federal class actions filed — Neff v. McBs LLC (1:25-cv-00235) and McCollum v. McBs LLC (1:25-cv-00240); MCBS has moved to dismiss
- Source: California Attorney General sample breach notice (https://oag.ca.gov/ecrime/databreach/reports/sb24-625528); Daily Dark Web (https://dailydarkweb.net/mcbs-llc-hit-by-pear-ransomware-in-significant-data-breach/); Law360 (https://www.law360.com/healthcare-authority/articles/2418505/ga-billing-firm-says-lack-of-harm-dooms-data-breach-row)
What Should You Do?
If you received a notice from MCBS, enroll in the complimentary identity protection services described in your letter as soon as possible before any stated deadline. Because both personal and health information may have been involved, you should also review your Explanation of Benefits statements and request a copy of your medical records to check for services you did not receive or errors you did not authorize. Place a fraud alert or credit freeze with Equifax, Experian, and TransUnion to limit unauthorized account openings. You can obtain a free copy of your credit report from each bureau once every 12 months at AnnualCreditReport.com or by calling 1-877-322-8228, and you should review those reports carefully for accounts or inquiries you do not recognize. If you discover signs of identity theft, report them at IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
