HackingData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTMediumContained
MCBS, LLC
bd_32aaf81428502adc · schema v1 · pii pii-v1
Full breach record for MCBS, LLC →MCBS, LLC, a medical billing services provider, notified the California Attorney General of an unauthorized access incident. An unauthorized individual gained access to the network between September 22 and September 26, 2025. MCBS learned of the incident on September 25, 2025, and confirmed data exfiltration on May 28, 2026. Affected data includes PHI, health records, and PII (including SSNs). The company engaged forensic investigators and is offering identity protection services.
Leak gap clock✗ Leak >180d39 weeks discovery → filing
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_8f3ea50c0a24e40cNew Hampshire State AGfiled 2026-06-29(3d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-625528
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 26, 2026
- Raw hash
- 6eb2ce979a4d5b812fdd74ae8df8d61600b57f3c3185b8128dd9b67656a57ba7
Reporting entity
- Name
- MCBS, LLCnorm: mcbs
- Domain
- mcbs.com
Victim entity
- Name
- MCBS, LLCnorm: mcbs
- Domain
- mcbs.com
Incident
- Discovered
- Sep 25, 2025
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- Not disclosed
- Data types
- PHIHEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unknown
- MITRE ATT&CK
- T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
- Threat actor
- External
- Regulator citations
- Notified California Attorney General
Compliance
- Time to disclose
- 39 weeks(274 days from discovery to filing)
- Compliance flags
- Leak >180d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.