“Had they taken action when first warned,
a recent breach exposing sensitive
patient data could have been prevented.”
Introduction
At IntelliSystems, we help organizations protect their most valuable asset: their data. But sometimes, warnings go unheeded and the consequences can be severe. This is a cautionary story about an Augusta, GA based medical billing practice that experienced repeated cybersecurity failures. Had they taken action when first warned, a recent breach exposing sensitive patient data could have been prevented.
Background: Our Early Involvement
Several years ago, our client received an email that was suspicious. We discovered that the sender’s email had been hijacked. The sender’s address that had been hacked was the very same medical billing practice mentioned above. One of our representatives reached out to inform them their emails had been hijacked and warned that their existing set up could be compromised. We also suggested an audit of their network and data, and recommended they address the issues immediately or switch to a provider with a stronger security posture. They opted to let their current cybersecurity provider “fix” it.
The First Breach: A Missed Opportunity
The email hijacking the client experienced was a serious cybersecurity breach. However, proper remediation could have prevented future risks. Unfortunately, the client chose to remain with their existing IT provider, leaving vulnerabilities unaddressed.
The Second Breach: History Repeats, On a Larger Scale
Recently, the practice, now operating under MCBS, LLC, was hit by a major ransomware attack orchestrated by the PEAR threat actor. The breach exposed a significant volume of sensitive data, including patients’ personally identifiable information (PII), protected health information (PHI), and employee records. Public reports indicate that millions of individuals may have been affected – which is a HIPAA violation.
What Went Wrong and What Could Have Prevented It
What went wrong
- Ignored early warnings after the first breach
- Stayed with an underperforming IT/security provider
- Inadequate network and data security for handling PHI/PII
- Underinvestment in ongoing cybersecurity
What should have been done
- Act promptly on security assessments; remediate vulnerabilities
- Migrate to a provider with proven security expertise and practices
- Implement robust security measures: encryption, segmentation, audits, incident response planning, strict access controls
- Treat security as a continuous, proactive investment
If the client had acted on our original information and upgraded to a well-managed security setup, this second breach (and the exposure of sensitive data) could have been avoided.
Lessons Learned
- Security warnings are not optional. Take threats seriously and act on them.
- Past breaches should trigger action, not complacency. Remediation is critical.
- “Cheap” IT usually means inadequate protection. Protecting sensitive data is worth the investment.
- Prevention is far less expensive than remediation. The costs of legal issues, fines, lost trust, and identity exposure typically exceed preventive measures.
- Choose your IT and Cybersecurity service provider carefully. Experience, security practices, transparency, and proactive maintenance matter.
Legal Aftermath: Case Dismissal Doesn’t Eliminate Risk
After the recent ransomware attack, a proposed class-action lawsuit was filed against MCBS, LLC (Rivera v. MCBS, LLC) on behalf of affected patients and employees. The case was dismissed by the court. According to public filings, the dismissal was based on procedural issues and legal standards for proving harm, rather than disputing that the breach or data exposure occurred.
Key Takeaway: A legal dismissal does not mean there was no breach or that sensitive data wasn’t exposed. The risk to patients, employees, and the organization itself was real. And it serves as a warning to all organizations that ignoring cybersecurity threats can have serious consequences, even if lawsuits are ultimately dismissed.
Conclusion
The breach at MCBS, LLC is a stark reminder: ignoring cybersecurity is literally gambling with people’s privacy and trust. At IntelliSystems, we don’t just identify risks, we help organizations fix them and stay protected. Don’t wait until it’s too late; take proactive action to secure your network, safeguard your data, and protect your organization’s reputation.
IntelliSystems
IntelliSystems serves business in Georgia and South Carolina with I.T. and Cybersecurity. For more information or to book a Cybersecurity Audit for your organization, click here.