North Carolina Pathology Laboratory Suffers 235K-Record Data Breach
An anatomic pathology laboratory and healthcare provider in North Carolina have experienced cyberattacks involving the theft of patient data.
Marlboro-Chesterfield Pathology, North Carolina
Marlboro-Chesterfield Pathology, P.C. (MCP) in Pinehurst, North Carolina, has recently reported a data breach to the HHS’ Office for Civil Rights that involved the theft of the protected health information of 235,911 individuals. The MCP breach notice explains that unauthorized activity was identified within some of its IT systems on or around January 16, 2025. The forensic investigation confirmed there was unauthorized access to files containing patient information, and certain records were copied from its network. A comprehensive review was conducted of the compromised files, and that process was completed on March 31, 2025.
The compromised data included names, addresses, dates of birth, medical treatment information, and health insurance information. MCP said, “We took steps, to the best of our ability and knowledge, to ensure that the data taken by the unauthorized party was deleted,” and at the time of issuing notification letters, no reports had been received of identity theft related to the data breach.
While not mentioned in the data breach notice, this was a ransomware attack by a group known as SafePay, which has conducted at least 178 ransomware attacks. SafePay added MCP to its data leak site but claims to have deleted the stolen data. That suggests that a ransom was paid. Individual notification letters have been sent to the affected individuals, and steps have been taken to strengthen network security.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Compassion Health Care, North Carolina
Compassion Health Care in North Carolina has announced a cybersecurity incident detected on March 17, 2025, that resulted in network disruption. Assisted by a cybersecurity firm, Compassion Health Care discovered on March 21, 2025, that an unauthorized third party had accessed its network and downloaded files that included patient, employee, and vendor information.
The stolen employee and vendor data included names, addresses, birth dates, Social Security numbers, income information, financial account information, and bank account and routing numbers. Patient data compromised in the incident included names, addresses, phone numbers, birth dates/ages, Social Security numbers, driver’s license numbers, health insurance information, diagnostic/clinical information, claims information, and other information related to medical services received from healthcare providers engaged by Compassion Health Care.
Notification letters were sent to the affected individuals on May 16, 2025, and complimentary credit monitoring and identity theft restoration services are being provided. The incident is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.
