N.C. Pathology Practice Notifying 236,000 of Data Theft Hack

A North Carolina pathology practice is notifying nearly 236,000 patients of a hacking incident discovered in January. Marlboro-Chesterfield Pathology says it “took steps” to ensure the hackers deleted its stolen data. Newcomer ransomware group SafePay is apparently the culprit in the attack.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The provider of molecular, cytology and pathology laboratory services reported the data breach to the U.S. Department of Health and Human Services on May 9 as a hacking incident involving a network server and affecting 235,911 individuals.

In a notice posted on its website, Pinehurst, N.C.-based MCP said that on or around Jan. 16, it experienced unauthorized activity on certain internal IT systems. “Based on our subsequent investigation, we determined that an unauthorized party accessed our systems and acquired certain records from our systems,” MCP said.

An investigation that concluded on March 31 determined that some patient information was contained in the affected records. “We took steps, to the best of our ability and knowledge, to ensure that the data taken by the unauthorized party was deleted,” MCP said.

Information potentially compromised in the incident includes name, address, date of birth, medical treatment information and health insurance information, such as policy numbers.

Ransomware.live is among the security monitoring firms attributing the attack to SafePay. Ransomware.live counts 178 Safegroup victims since the ransomware group first emerged in November 2024.

Law group Lyon Firm – one of many practices that have said in recent days saying they’re investigating the MCP for potential class action litigation – also said an investigation into the MCP incident concluded that the Safepay ransomware group was behind the attack and exfiltration of approximately 30 gigabytes of sensitive data.

“The SafePay ransomware group claimed responsibility for the attack on a darkweb post on Jan. 25,” The Lyon Firm said.

Darkweb monitoring platform Ransomware.live also found MCP listed on SafePay’s data leak site, but as of Friday the pathology practice’s data appears to have been removed from the gang’s site.

“SafePay is an emerging ransomware strain believed to be derived from leaked LockBit source code,” wrote security firm Cybervergent in a recent blog post. “Its signature traits include a ransom note titled readme_safepay.txt and encrypted file extensions labeled .safepay. Analysts point to its uncanny similarities to LockBit, but SafePay’s refined approach makes it a new beast in the ransomware landscape,” Cybervergent wrote.

MCP said that since it discovered the incident, the pathology practice has implemented “measures to contain the unauthorized access and further strengthen the security of our networks.

MCP did not immediately respond to Information Security Media Group’s request for additional details about the hacking incident.