Vanta Diagnostics

Summary

Vanta Diagnostics, a healthcare diagnostic firm recently rebranded from Vikor Scientific, disclosed that a data breach exposed the personal information of approximately 140,000 individuals. The compromised data, which included names, dates of birth, payment card details, medical records and health insurance information, was stored by Catalyst RCM, a revenue cycle management provider that handles medical coding and billing for the firm and its affiliated laboratories KorPath and Korgene. Investigators found that attackers used compromised credentials to access Catalyst’s secure file management system, and the Everest ransomware group later listed the companies on its leak site and published the stolen data. Catalyst, KorPath and Korgene have not yet reported the number of affected individuals to the Department of Health and Human Services, leaving it uncertain whether the 139,964 figure represents the total impact or a subset.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Catalyst RCM detected suspicious activity within its secure file management system in mid‑November 2025. An investigation revealed that compromised credentials had been used to gain access to the system. The files accessed contained names, dates of birth, payment card details, medical information, and health insurance information. Catalyst stated that the data was in its possession because it provides medical coding and billing services to Vikor Scientific, KorPath, and Korgene. Catalyst published a data breach notice on its website earlier this month (January 2026) detailing the incident.

The breach came to public attention when the Everest ransomware group listed Vikor Scientific, along with its affiliates KorPath and Korgene, on its leak website in November 2025. The group subsequently published data allegedly stolen from the companies. The U.S. Department of Health and Human Services tracker records Vikor Scientific (recently rebranded as Vanta Diagnostics) as the victim of a breach affecting 139,964 individuals. Catalyst, KorPath, and Korgene have not yet submitted their own impact numbers to the HHS, leaving it unclear whether the 139,964 figure represents the total affected population or a subset.

Catalyst’s response included notifying the individuals whose data was compromised and providing details of the stolen information categories. Vikor Scientific disclosed the breach through the HHS tracker, confirming the number of affected individuals. The source material does not contain further specifics on containment measures, eradication steps, or post‑incident monitoring undertaken by any of the involved entities.

Sources

Sources available to members: 1 source.