Professional Finance

Disclosed May 3, 20221,972,699 affectedConfirmed

Ransomware at debt collector PFC exposes data of 1.9 million patients

Debt collection firm PFC disclosed on July 1, 2022 that a February ransomware attack affected more than 650 healthcare provider clients, exposing patient names, addresses and balances and in some cases birth dates, SSNs and health insurance and treatment data. It told HHS that more than 1.91 million patients were affected.

What is known

People affected	1,972,699 (as reported by the organization)
Disclosed	May 3, 2022
Discovered	Feb 26, 2022
Happened	Feb 22, 2022
Attack	Ransomware
Data exposed	NamesAddressesDates of birthSocial Security numbersInsuranceHealthFinancial
Sector	Finance · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Professional Finance

Official noticeatg.wa.gov

Washington Attorney General breach notice: Professional Finance

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Professional Finance

Newstechcrunch.com

A ransomware attack on a debt collection firm is one of 2022's biggest health data breaches

Official noticein.gov

Indiana Attorney General 2022 data breach report: Professional Finance

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Professional Finance (Business Associate, CO)

Notices filed

Residents of INMay 3, 2022

Indiana AG15,384 people

Residents of CAJul 1, 2022

California AGCount not stated

Residents of WAJul 1, 2022

Washington AG18,346 people

Residents of ORJul 1, 2022

Oregon DOJCount not stated

TotalJul 1, 2022

Research1,910,000 people

TotalJul 1, 2022

HHS archive1,918,941 people

History of this record

source2026-09-25

empty to https://ocrportal.hhs.gov/ocr/breach/breach_report.jsfby backfillSource

records2026-09-25

1910000 to 1972699by backfillSource

disclosed2026-09-25

2022-07-01 to 2022-05-03by backfillSource

data_types2026-09-25

[] to ["names","addresses","dob","ssn","insurance","health","financial"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 1910000by seedSource

summary2026-09-25

empty to Debt collection firm PFC disclosed on July 1, 2022 that a February ransomware attack affected more than 650 healthcare provider clients, exposing patient names, addresses and balances and in some cases birth dates, SSNs and health insuranceby seedSource

title2026-09-25

empty to Ransomware at debt collector PFC exposes data of 1.9 million patientsby seedSource

attack2026-09-25

unknown to ransomwareby backfillSource

discovered2026-09-25

empty to 2022-02-26by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Professional Finance