Professional Finance
Disclosed May 3, 20224 years ago1,972,699 affectedConfirmed
Ransomware at debt collector PFC exposes data of 1.9 million patients
Debt collection firm PFC disclosed on July 1, 2022 that a February ransomware attack affected more than 650 healthcare provider clients, exposing patient names, addresses and balances and in some cases birth dates, SSNs and health insurance and treatment data. It told HHS that more than 1.91 million patients were affected.
What is known
| People affected | 1,972,699 (as reported by the organization) |
|---|---|
| Disclosed | May 3, 2022 |
| Discovered | Feb 26, 2022 |
| Happened | Feb 22, 2022 |
| Attack | Ransomware |
| Data exposed | Names, Addresses, Dates of birth, Social Security numbers, Insurance, Health, Financial |
| Sector | Finance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Professional Financeoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Professional Financeatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Professional Financejustice.oregon.gov · Official notice | Official notice |
| A ransomware attack on a debt collection firm is one of 2022's biggest health data breachestechcrunch.com · News | News |
| Indiana Attorney General 2022 data breach report: Professional Financein.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Professional Finance (Business Associate, CO)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Indiana AGresidents of IN | May 3, 2022 | 15,384 |
| California AGresidents of CA | Jul 1, 2022 | |
| Washington AGresidents of WA | Jul 1, 2022 | 18,346 |
| Oregon DOJresidents of OR | Jul 1, 2022 | |
| Researchtotal | Jul 1, 2022 | 1,910,000 |
| HHS archivetotal | Jul 1, 2022 | 1,918,941 |
History of this record
- 2026-09-25 · source: empty to https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf · backfill source
- 2026-09-25 · records: 1910000 to 1972699 · backfill source
- 2026-09-25 · disclosed: 2022-07-01 to 2022-05-03 · backfill source
- 2026-09-25 · data_types: [] to ["names","addresses","dob","ssn","insurance","health","financial"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 1910000 · seed source
- 2026-09-25 · summary: empty to Debt collection firm PFC disclosed on July 1, 2022 that a February ransomware attack affected more than 650 healthcare provider clients, exposing patient names, addresses and balances and in some cases birth dates, SSNs and health insurance · seed source
- 2026-09-25 · title: empty to Ransomware at debt collector PFC exposes data of 1.9 million patients · seed source
- 2026-09-25 · attack: unknown to ransomware · backfill source
- 2026-09-25 · discovered: empty to 2022-02-26 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.