3rd Party Risk Management
,
Data Breach Notification
,
Data Security
Ransomware Gang Everest Claims It Has Leaked All Stolen Data
A revenue cycle management software firm is notifying patients of several related medical diagnostic laboratories that hackers stole their sensitive information, including diagnoses and medical treatments, in a November hack.
See Also: Reduce Cloud Risk in Healthcare with Security by Default
Ransomware gang Everest Group claimed to be behind the incident, publishing stolen data on its leak website.
Catalyst RCM, which is headquartered in Texas, is sending breach notification letters to an undisclosed number patients of at least three of its diagnostic laboratory clients.
Those laboratory clients include KorPath, a pathology testing services firm, Korgene, a molecular diagnostic lab specializing in pathogen detection and Vikor Scientific, which specializes in antibiotic resistance testing and related services.
Korgene is part of Vikor Scientific, which recently rebranded its company as Vanta Diagnostics. KorPath on its website also says it partners with Vanta Diagnostics for some testing services.
Catalyst said in its breach notification letter that it provides medical coding and billing services to the three labs.
In the notification letter, Catalyst RCM said that on Nov. 13, 2025, it was “made aware of suspicious activity related to certain information maintained within its secure file management system.”
An internal investigation determined that hackers used an authorized login and password to access a server between Nov. 8 and Nov. 9, 2025. Data was copied without permission “creating an unauthorized use of the data,” Catalyst RCM said.
Catalyst RCM describes itself as a “data centric” revenue cycle management company offering specialized medical billing, coding and business analytics products and services to healthcare providers across the United States.
Catalyst RCM in a statement posted on its website said that in the aftermath of the incident, the company has reviewed and updated its protocols, policies and procedures.
Everest Group on its darkweb leak site lists Vikor Scientific, Korgene and KorPath as November 2025 victims. Everest claims data for all three labs is published and “duplicated across various hacker forums and leak database sites” due to the companies failing to “respond by deadline” to the gang’s demands.
For Vikor Scientific and Korgene, Everest claims it respectively has 9.39 gigabytes and 505 megabytes of the labs’ data. That includes 25,303 Vikor PDFs and 1,344 Korgene PDFs containing patients’ medical records, billing information and other “private information,” Everest claims.
KorPath’s hacked database contained more than 1.2 GB of data, including nearly 7,500 PDFs featuring “a huge variety of personal documents,” such as electronic medical records, billing information and other sensitive information, Everest claims.
Several law firms say they are investigating the Catalyst RCM incident for potential class action litigation.
Catalyst RCM is among a long and growing list of revenue cycle management, medical coding and billing services vendors reporting significant health data breaches in recent months and years (see: FieldTex, Trizetto Reveal New Healthcare Breaches).
The most notable revenue management breach to date involved Change Healthcare, a UnitedHealth Group unit that offers medical coding, billing and many other related IT services to the healthcare sector.
A 2024 cyberattack on Change Healthcare launched by Russian-speaking ransomware gang AlphV/BlackCat resulted in a health data breach affecting thousands of its clients and more than 193 million individuals in the U.S.