MCG Health
| Primary URL | Location | Industry | www[.]mcg[.]com |
Country
United States of America
|
Healthcare
|
|---|
Profile
MCG Health operates within the healthcare sector in the United States. While specific details regarding its core products, services, market scope, and organizational structure are not explicitly detailed in the provided source material, the known incident reveals its involvement with sensitive patient information across multiple healthcare provider clients. This indicates a role in handling or processing protected health data on behalf of other healthcare entities. The scale of the incident suggests MCG Health manages significant volumes of personal and medical information, impacting a large client base.
The organization experienced a major cybersecurity incident discovered around February 25, 2020. Unauthorized actors gained access to systems containing highly sensitive patient data belonging to clients. This breach compromised information for over 1.1 million individuals, including names, Social Security numbers, medical codes, addresses, phone numbers, email addresses, dates of birth, and gender identifiers. The attackers demanded payment for the stolen records, prompting involvement from the Federal Bureau of Investigation. Investigations confirmed that portions of the compromised patient data subsequently appeared for sale on the dark web, validating the breach's severity.
Conflicting information emerged regarding the timeline of the breach discovery. External claims suggested the initial unauthorized access occurred significantly earlier than MCG Health's official detection date, raising questions about the duration of exposure. Following the incident, MCG Health implemented enhanced security measures and undertook notification procedures to inform the affected healthcare provider clients and, by extension, the impacted individuals. Despite these actions, the full extent of the data exposure and the ultimate fate of all compromised information remained unclear following the breach disclosure. The incident underscored the substantial risks associated with handling sensitive healthcare data at scale.