Harbin Clinic Reports Cyber Breach Affecting 210,140 Americans

A major cybersecurity incident has been disclosed, impacting the personal and financial information of 210,140 Americans. The breach was revealed by Harbin Clinic, a Georgia-based healthcare firm, in a recent filing with the Office of the Maine Attorney General. The incident involved an unauthorized access to the database of Nationwide Recovery Services (NRS), a third-party vendor used by Harbin Clinic for debt collection services.

The breach occurred between July 5th and July 11th, 2024, during which an unknown attacker copied sensitive customer records, including names, addresses, Social Security numbers, dates of birth, and financial account records. NRS discovered suspicious activity in July 2024, which led to a network outage and subsequent investigation. The investigation revealed that unauthorized access had occurred, and certain files and folders were illegally copied from NRS’s systems.

Harbin Clinic, which offers a wide range of medical services including family medicine, internal medicine, oncology, and cardiology, was notified by NRS in February 2025 that patient information may have been compromised. However, NRS was unable to identify which specific individuals had been affected at that time. Harbin Clinic promptly sent notification letters to affected customers, offering free identity monitoring services to mitigate potential risks. The firm has not detected any misuse of customer data to date but urges customers to remain vigilant and report any suspicious activity related to their financial accounts.

The incident underscores the growing threat of cybersecurity breaches in the healthcare sector, where sensitive personal and financial information is often targeted. The breach at Harbin Clinic highlights the importance of robust cybersecurity measures and the need for timely disclosure and response to such incidents. The firm's proactive approach in notifying affected individuals and offering identity monitoring services demonstrates a commitment to protecting patient data and mitigating potential harm.