KorPath

Summary

Vikor Scientific, a healthcare diagnostic firm, disclosed that nearly 140,000 individuals were affected by a data breach that originated from a compromise of its revenue cycle management provider. The breach exposed names, dates of birth, payment card details, medical information, and health insurance information belonging to patients of the firm and its affiliated diagnostic laboratory companies KorPath and Korgene. The service provider detected suspicious activity after compromised credentials were used to access its file system, and the ransomware group later listed the companies on its leak site, though the exact total of impacted individuals remains uncertain.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In mid‑November 2025 Catalyst RCM detected suspicious activity within its secure file management system and launched an investigation that revealed compromised credentials had been used to gain access. The investigation determined that the files exfiltrated by the attackers contained names, dates of birth, payment card details, medical information, and health insurance information. Catalyst RCM provides medical coding and billing services to Vikor Scientific, KorPath, and Korgene, and the compromised data was in its possession because of those services. The breach was not a direct attack on Vikor Scientific or its affiliates but originated from the third‑party provider.

In November 2025 the Everest ransomware group posted Vikor Scientific, along with its affiliated diagnostic laboratory companies KorPath and Korgene, on its leak website and later published data allegedly stolen from the companies. Vikor Scientific disclosed the incident to the public in recent days, stating that nearly 140,000 individuals were affected. The U.S. Department of Health and Human Services’ healthcare breach tracker lists Vikor Scientific (recently rebranded as Vanta Diagnostics) as the victim of a breach compromising the information of 139,964 individuals. Catalyst RCM, KorPath, and Korgene have not yet submitted their own impact numbers to the HHS tracker.

Catalyst RCM published a data breach notice on its website earlier this month and notified the individuals whose information was compromised. Vikor Scientific’s disclosure contributed to the HHS tracker entry, while KorPath and Korgene have not provided separate figures to the agency. It remains unclear whether the 139,964 figure represents the total number of affected individuals or if the actual count is higher.

Sources

Sources available to members: 1 source.