Mid Michigan Medical Billing Service Data Breach 2026 (Qilin Ransomware): 28,185 Patients Across Multiple Michigan Providers Exposed. What To Do

What happened

Mid Michigan Medical Billing Service, Inc. (MMMBS) is a Flint, Michigan-based revenue-cycle-management and medical-billing business associate serving multiple Michigan medical practices over approximately 22 years. Services include medical billing, transcription, records management, and RCM consulting for “medical clinics large and small” as well as third-party payers.

On March 27, 2025, MMMBS detected suspicious activity. An unauthorized third party had accessed the network and copied files. The Qilin ransomware group claimed responsibility, listed MMMBS on its dark-web leak site, and asserted approximately 38 GB of exfiltrated files with a threat of publication absent ransom payment.

The forensic review concluded on December 2, 2025. MMMBS posted a substitute notice on January 2, 2026, filed with HHS OCR on January 5, 2026 (28,185 affected), and notified its downstream covered-entity clients privately. The specific Michigan provider clients have not been publicly named.

What was stolen

Per MMMBS’s notice, exposed data may have included:

• Full name, date of birth
• Driver’s license / government ID
• Medicare / Medicaid ID
• Diagnosis and treatment information
• Medical record / patient account number
• Health insurance information
• Payment card number
• Employer ID
• Passport number
• Treating / referring provider name
• Biometric data
• Social Security number (for a limited subset)

The breadth is unusually wide — biometric and passport data is rare in healthcare-breach exposure profiles.

Who is affected (downstream)

MMMBS notified its covered-entity clients privately and the clients have not publicly attributed themselves. If you have received care from a Michigan medical practice that contracts billing through MMMBS at any point since approximately 2018, you may be affected. Watch your mail for an MMMBS-branded notification letter — not just from your specific clinic.

What MMMBS is offering

• Complimentary credit monitoring for affected individuals (vendor and duration not enumerated in public sources)
• Dedicated hotline: 833-303-3875 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)

What to do

1. Enroll in the monitoring through the activation code in your letter.
2. Place free credit freezes at all three bureaus.
3. Cancel and reissue any payment cards stored with your MMMBS-billing provider.
4. Stop the ongoing flow of your billing and treatment data. HealthConsent files HIPAA restriction requests so the demographic and treatment-context data exposed in this breach is not continuously re-shared by downstream entities.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches