Marlboro-Chesterfield data breach impacts 235,000 patients

Marlboro-Chesterfield Pathology (MCP), a full-service anatomic pathology laboratory, has suffered a data breach, which resulted in threat actors stealing sensitive patient records.

MCP wrote in a breach notification that on or around January 16th, 2025, the pathology lab experienced unauthorized activity within its IT systems.

The lab investigated, employing third-party specialists, and found that threat actors had accessed its systems, stealing sensitive records.

In a filing to the US Department of Health and Human Services (HHS), the institution said that over 235,000 individuals had been affected by the breach.

The information stolen by hackers includes:

• Names
• Addresses
• Dates of birth
• Medical treatment information
• Health insurance information, such as policy numbers

Health information is extremely valuable in the cybercrime world, as it usually doesn’t tend to change over time.

This kind of sensitive information could be used by threat actors to launch highly personalized and sophisticated attacks. Furthermore, cybercriminals can use it to profile patients and commit various forms of fraud, from identity theft to phishing attacks.

Threat actors searching for huge unsecured databases could use this information to open new credit accounts, make unauthorized purchases in your name, or obtain loans under false pretenses.

“As of this writing, we have not received any reports of identity theft related to this incident,” MCP assured affected individuals.

The laboratory said that it “promptly began taking steps to secure and restore all affected systems,” suggesting that some of their systems were rendered unusable.

While MCP didn’t explicitly state what kind of attack was launched on their systems, all signs point to ransomware.

The ransomware group, SafePay, supposedly claimed the attack on MCP in late January, according to Security Week.

The cybersecurity news outlet said that MCP is no longer listed on the ransomware gangs leak site, suggesting that a ransom may have been paid.