- Medusind begins notifying victims of a data breach in December 2023
- The incident caused 360,000 people to lose payments and personal data
- The company offers two years of free identity theft monitoring.
Medusind, a major medical billing company, has confirmed that it suffered a cyberattack in which hundreds of thousands of people lost sensitive data, including payment information.
In a data breach notification letter, the company said the incident occurred on December 29, 2023 and was detected on the same day. Since Medusind is a healthcare revenue cycle management company, it provides billing support to healthcare organizations, and it is the patients of these healthcare companies who have had their data stolen in this attack.
A detailed investigation of the attack found that the threat actors stole billing and health insurance information (insurance policy numbers or claims/benefits information), payment information (debit/credit card numbers, bank account information) , health data (medical history, medical history, registration number, prescription information), government identification information (Social Security numbers, taxpayer IDs, driver’s licenses, passport numbers), and other personal information (email addresses email, phone numbers, dates birth and more), all of which could put victims at risk of identity theft or worse.
Hundreds of thousands of victims
In a separate filing with the Maine Attorney General’s Office, Medusind confirmed that exactly 360,934 people have been affected.
“The particular type of information involved depends on the individual,” the letter emphasizes.
There is currently no evidence that data has been abused in the wild, and Medusind offers two years of free identity theft monitoring through Kroll. It also urged victims to monitor their account statements for unexpected or strange entries that could indicate identity theft or fraud attempts, and to report them to authorities.
Due to the sensitivity of the data they operate and the high cost of recovery, healthcare organizations are among the most targeted by ransomware actors. In fact, a recent Sophos analysis found that the average cost to recover from a ransomware attack was $2.57 million in 2024, up from $2.2 million the previous year.
