BBS Financial Services paid a ransom after breach affecting 70,168 people

BBS Financial Services, an accounting, payroll and medical billing firm based in Methuen, Massachusetts that serves clients across Massachusetts and southern New Hampshire, filed a data breach notice with the Maine Attorney General on November 11, 2024 and sent notification letters to affected individuals. The filing put the total at 70,168 people, including 1,404 Maine residents and 716 in Texas.

The firm said an unauthorized party reached its server network in December 2023 and exfiltrated files before demanding payment for their deletion. BBS became aware of the intrusion on January 29, 2024. Comparitech reported the attack was attributed to the BianLian extortion group, which never posted BBS on its public leak site.

The data exposed varied by service line. Tax and payroll clients had names, addresses, dates of birth, Social Security numbers, government-issued identification numbers, financial account numbers and completed tax filings including K-1 schedules taken. Medical billing clients had names, addresses, dates of service, procedure and billing codes and health insurance carrier details exposed.

BBS said it worked with outside counsel, forensic investigators and the FBI, judged the attacker's claims credible, negotiated and paid an undisclosed ransom, and afterwards obtained what it called credible evidence that all exfiltrated data had been destroyed. It notified the Internal Revenue Service to guard against fraudulent tax filings and offered affected individuals two years of credit monitoring and identity theft protection through Equifax. Several plaintiffs' firms announced investigations in the weeks after the letters went out.