MCBS, LLC listed on pear ransomware leak site

• Ransomware group: pear
• Country: United States
• Sector: Healthcare
• Announcement date: September 30, 2025

MCBS, LLC targeted by pear ransomware group

The healthcare management services provider MCBS, LLC has been listed on a leak site associated with the pear ransomware group. The threat actor, identified as pear, claims to have successfully compromised the organization's network, leading to a significant data breach. This announcement, made on September 30, 2025, follows an alleged intrusion that occurred on September 25, 2025. The group is currently using the threat of releasing stolen data to exert pressure on the organization.

Details of the alleged breach

According to the claims made by the pear ransomware group, the breach involved a substantial volume of information. The threat actor asserts that they have accessed 1.2 TB of data belonging to MCBS, LLC. While the group has published a leak announcement, public information regarding the specific tactics, techniques, and procedures used by this group remains limited.

The announcement specifies that the stolen information is quite diverse, covering various sensitive categories. The data allegedly exfiltrated by the attackers includes the following:

• Financial data
• Corporate documents
• Patient data
• Employee data
• Address information
• Payment information
• Medical records
• Correspondence

This type of incident is characteristic of a double-extortion ransomware attack. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to publish the stolen information on a public leak site, the attackers attempt to coerce the victim into paying a ransom to prevent the exposure of confidential records.

About MCBS, LLC

MCBS, LLC is an organization that provides a comprehensive range of management services to healthcare providers. The company specializes in assisting businesses within the healthcare sector by managing their various operational processes. Because of its role in managing operations for other healthcare entities, the organization occupies a critical position within the healthcare ecosystem.

Risk assessment and industry implications

The nature of the data claimed to be stolen carries significant implications for both the organization and the individuals whose information is involved. Given that the leaked data reportedly includes medical records and patient information, the organization may face regulatory scrutiny and potential sanctions under frameworks designed to protect health data, such as HIPAA. The exposure of such sensitive information often leads to long-term consequences for the affected parties.

For individuals, the compromise of patient and employee data can create secondary risks, including the potential for identity theft and the execution of highly targeted phishing attacks. Furthermore, because MCBS, LLC provides management services to other healthcare providers, this incident may be viewed as a supply chain risk, where a breach at a service provider impacts the broader network of clients.

The publication of this data can result in substantial reputational damage and significant operational disruptions for the organization. In the healthcare sector, maintaining the integrity and confidentiality of data is paramount. To mitigate such risks, organizations typically focus on robust defensive measures, such as implementing strict access controls, maintaining comprehensive logging and monitoring, and ensuring regular security assessments to identify vulnerabilities before they can be exploited by threat actors.