Extortion Gang PEAR Claims Theft of 3.3TB of MCBS LLC’s Client and Patient Data
A significant cybersecurity breach has emerged from a Georgia-based medical billing firm, which has initiated notifications to nearly 1.3 million patients regarding a data compromise that took place in 2025. This incident, tied to seven healthcare practices, is being classified as one of the largest health data breaches recorded in the current year, creating ripples across the industry. The notorious extortion group known as PEAR, identified as standing for Pure Extraction and Ransom, has claimed responsibility for the theft, asserting they pilfered a staggering 3.3 terabytes of sensitive data belonging to MCBS LLC.
Emerging reports reveal that PEAR started making its presence felt in June 2025. This group has reportedly carved a niche by functionally operating as a data broker and extortion outfit that notably bypasses the traditional method of encrypting victims’ IT systems and data, instead focusing on data theft, as analyzed by threat intelligence researchers.
The breach itself was detected by MCBS on September 25, 2025, when abnormal network activities indicated unauthorized access. Upon further examination, it was concluded that this compromise involved potential access to or removal of certain files between September 22 and September 26. The compromised files contained a plethora of sensitive patient information, including but not limited to names, addresses, Social Security numbers, dates of birth, health plan beneficiary numbers, health insurance details, as well as medical histories and diagnoses. The specifics of the compromised information varied for each individual, indicating a broad and detailed scope of the data exfiltration.
The patient data breach affected individuals serviced by seven clients of MCBS, including notable names such as C&C MD, Nuclear Medicine and Pathology Associates, and Vascular Radiology Associates II. While MCBS has publicly stated that they possess "no evidence of any identity theft related to this incident," the claims made by PEAR on its dark web portal are alarming. They assert that they have 3.3 terabytes of data ripe for download, comprising not just patient protected health information (PHI) and personally identifiable information (PII), but also financial, human resources, and business operations data from the medical billing firm and its clients.
In the aftermath of the breach, MCBS has faced at least one proposed federal class action lawsuit. The lawsuit accuses PEAR of having "successfully breached" and exfiltrated highly sensitive data through the "inadequately protected computer systems" of the firm. The legal ramifications of this incident are likely to be severe, not just for the firm but also for the healthcare practices that have associated with it.
As of the latest updates, MCBS has not provided a detailed response to inquiries regarding PEAR’s claims on the dark web nor shared additional insights about the hacking incident itself. The consequences of this breach continue to unfold, with potential legal and reputational repercussions.
The broader context surrounding PEAR is alarming, as the group had reportedly accumulated a list of 51 victims spanning various industries, which notably included healthcare, as of February 2026. This cybercriminal organization has been generating ransoms averaging $550,000, according to research conducted by cyber insurance and security services firm At-Bay, who have scrutinized attacks executed by the gang.
At-Bay indicates that PEAR typically gains initial access via compromised virtual private network (VPN) credentials. Unlike traditional ransomware groups that deploy custom malware, PEAR utilizes established remote management tools such as AteraAgent and Splashtop Remote Service. This technique complicates detection efforts, as these tools are ordinarily utilized for legitimate administrative tasks.
Moreover, PEAR’s strategy extends to employing common tools like PsExec for remote execution and credential dumping utilities that extract passwords from memory. The group also relies on file transfer applications like RClone and WinSCP to efficiently exfiltrate data from compromised networks. This modus operandi presents a unique challenge for cybersecurity defenders, who face difficulties in discerning malicious activity amid legitimate software operations.
In addition to their technical tactics, PEAR is noted for their "aggressive victim communication," which differentiates them from other extortion groups. Instead of only relying on ransom notes or anonymous dark web contact forms, PEAR directly communicates with company employees via text messages and WhatsApp, making direct claims about their data theft.
Currently, the MCBS hack ranks as the seventh largest of 384 health data breaches reported thus far in 2026, according to the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool. Notably, it stands as the fifth largest incident among 155 reported breaches in 2026 that involved third-party business associates.
The implications of the MCBS incident serve as a stark reminder of the ongoing threats posed by cybercriminals, particularly in the healthcare sector, where sensitive patient information is a prime target for exploitation. The active investigation and subsequent actions taken by both MCBS and regulatory bodies are awaited with bated breath as stakeholders assess the full scale of the consequence this breach may have on patients and healthcare practices alike.