A collection agency that collects healthcare debt has reported a data breach impacting the personal information of more than 345,000 consumers after uncovering that certain files were copied from its network.
A copy of the letter sent out by R&B Corporation of Virginia, doing business as Credit Control Corporation, can be accessed by clicking here.
The company has filed notifications with the Department of Health and Human Services and with the Maine Attorney General. The notification with HHS indicated that 345,523 individuals were impacted and that the location of the breached information was a network server. The company is a business associate to a variety of healthcare organizations. The notification with the Maine AG’s office indicated that the total number of persons affected was 286,699.
“On March 7, 2023, CCC became aware of unusual activity involving certain systems within our network,” the company said in the letter it sent out to affected individuals. “We promptly isolated the systems, and, with the assistance of third-party forensic specialists, commenced a comprehensive investigation into the nature and scope of the activity. On or about March 14, 2023, the investigation determined that certain files were copied from our network as part of a cyber incident that occurred between March 2, 2023, and March 7, 2023.”
The company began notifying individuals earlier this month. The information that was obtained through the breach included individuals’ names, Social Security numbers, addresses, and information about their accounts with different healthcare providers, such as balances and account numbers. The breach impacted individuals who were patients of the following healthcare organizations:
- Atlantic Orthopaedic Specialists
- Chesapeake Radiology
- Children’s Specialty Group
- Dominion Pathology Laboratory
- Emergency Physicians Of Tidewater
- Mary Washington Healthcare
- Medical Center Radiology
- Riverside Health System
- Sentara Health System
- Valley Health System
