Credit Control Corporation disclosed March 2023 breach affecting hundreds of thousands

R&B Corporation of Virginia, which trades as Credit Control Corporation, notified regulators and consumers in May 2023 that an intruder had reached its network earlier in the year and copied files containing personal data.

The Newport News debt collection agency said it detected unusual activity on March 7, 2023 and determined on March 14 that an unauthorized party had been inside its systems between March 2 and March 7. Its review of the affected files finished on May 3, and notification letters went out on May 15.

Reported victim counts differ by regulator. The filing with the Maine Attorney General's office listed 286,699 individuals, while the report to the U.S. Department of Health and Human Services Office for Civil Rights listed 345,523. Exposed information included names, addresses and Social Security numbers, and for some people account numbers, balances and dates of service tied to the healthcare providers that had referred their debts.

Because the company collects medical debt, much of the affected population came through hospital and physician clients. Reporting identified between 15 and 16 healthcare organizations whose patients were caught in the incident, among them Sentara Health System, UVA Health System, Children's Hospital of the King's Daughters and Riverside Health System.

The company said it isolated affected systems, engaged outside forensic specialists, offered credit monitoring through Kroll and increased staff security training. Class action suits were filed within weeks of the notification, several citing the roughly two month gap between the company determining on March 14 that an intruder had been in its systems and consumers being notified on May 15.