210K American clinics‘ patients had their financial data leaked
Georgia-based Harbin Clinic had hundreds of thousands of its patients exposed after attackers hacked the clinic‘s third-party vendor, Nationwide Recovery Services (NRS).
Image by Cybernews.
Georgia-based Harbin Clinic had hundreds of thousands of its patients exposed after attackers hacked the clinic‘s third-party vendor, Nationwide Recovery Services (NRS).
Harbin Clinic started informing patients that their data had been lost after attackers hit NRS in July 2024. NRS is a third-party vendor that has provided debt collection services at Harbin Clinic and services related to bankruptcies, lawsuits, and patient estate matters.
After the attack, NRS conducted a somewhat lengthy investigation into what and whose data was lost during the attack. The company notified Harbin in February 2025, and it took the clinic another three months to inform people impacted by the attack. Which means that people whose data was stolen last July are only now learning about the breach.
Data that Harbin Clinic submitted to the Maine Attorney General's Office indicates that over 210,000 people were impacted by the third-party data breach. What makes matters worse is the sensitivity of the information cybercrooks stole. According to the breach notification letter, the exposed details involve:
- Names
- Addresses
- Social Security numbers (SSNs)
- Dates of birth
- Financial account information
Attackers crave personal user data - once stolen, SSNs, individual names, and other sensitive details quickly end up on underground marketplaces, where cybercriminals can buy it to use in whichever way they like. The most common use of stolen details is identity theft.
Losing financial account details is particularly dangerous as, at least in theory, attackers could try setting up credit lines, commit tax fraud, or even access user accounts.
While in many such cases, companies tend to provide impacted individuals with complementary identity theft and credit monitoring services, Harbin Clinic issued a recommendation for users to monitor their financial accounts.
Headquartered in Rome, Georgia, Harbin operates tens of locations throughout the state and employs over 1,400 staff.