Medical Debt Collection Firm R1 RCM Hit in Ransomware Attack
Summary: R1 RCM Inc., a Chicago-based medical debt collection company with more than 19,000 employees and contracts with at least 750 healthcare organizations, took down its systems in response to a ransomware attack. Sources close to the investigation told KrebsOnSecurity the malware is Defray, first spotted in 2017 and known for targeting healthcare companies, typically spread through booby-trapped Microsoft Office documents sent in small, targeted phishing emails.
What you should know: R1 RCM holds names, dates of birth, Social Security numbers, billing information and medical diagnostic data on tens of millions of patients, and Corvus Insurance estimates 75 percent of healthcare companies do not use email scanning and filtering technology that can catch ransomware lures.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026