Catalyst RCM

Summary

A ransomware group posted the names of healthcare diagnostic company Vikor Scientific and its affiliated laboratories KorPath and Korgene on a leak site after allegedly obtaining data from Catalyst RCM, a revenue‑cycle management provider. Catalyst detected suspicious activity in its secure file management system, traced the intrusion to compromised credentials, and found that the accessed files contained names, dates of birth, payment card details, medical information and health insurance data for the clients it serves. The compromised information was later published by the attackers, affecting nearly 140,000 individuals whose records were held by Vikor Scientific, KorPath and Korgene through Catalyst’s billing services. Catalyst has issued a breach notice to those individuals, though the exact number of impacted parties has not been separately disclosed by the affiliated labs.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In November 2025 the Everest ransomware group listed Vikor Scientific, along with its affiliated diagnostic laboratory companies KorPath and Korgene, on its leak website. The group subsequently published data that it claimed had been stolen from those companies. The breach was not a direct attack on Vikor, KorPath or Korgene but originated from Catalyst RCM, a provider of revenue cycle management solutions. Catalyst RCM reported detecting suspicious activity within its secure file management system in mid‑November 2025. An investigation by Catalyst determined that compromised credentials had been used to gain access to the system.

Catalyst RCM issued a data breach notice on its website earlier in January 2026, detailing the incident. The probe showed that the files accessed by the attackers contained names, dates of birth, payment card details, medical information and health insurance information. According to Catalyst’s notification, the compromised data was in its possession because it provides medical coding and billing services to Vikor Scientific, KorPath and Korgene. The U.S. Department of Health and Human Services breach tracker lists Vikor Scientific (recently rebranded as Vanta Diagnostics) as the victim of a breach affecting 139,964 individuals. Catalyst, KorPath and Korgene have not yet disclosed the number of impacted individuals to HHS, and it remains unclear whether the 139,964 figure represents the total affected population.

Nearly 140,000 people are reported to be affected by the breach disclosed by the healthcare diagnostic firm. The incident came to public attention through the HHS tracker and the ransomware group’s leak site. No further details about attacker motives, remediation steps or ongoing investigations are provided in the source material. The narrative is limited to the confirmed facts presented in the article.

Sources

Sources available to members: 1 source.