Financial Business and Consumer Solutions, a Pennsylvania debt collection agency that pursues charged off consumer accounts including car loans, medical bills and student debt, disclosed that an intruder had been inside its network for roughly two weeks in February 2024. The company said the unauthorised access ran from 14 February and was detected on 26 February.
The agency filed its first notice with the Maine attorney general on 26 April 2024, putting the number of affected people at about 1.9 million. It then filed a series of supplemental notices as its forensic review continued. By 10 May the figure had reached 2.7 million, and by the end of May it stood at 3,226,631. The total kept climbing through the summer and reached 4,253,394 by late July.
Exposed records varied by individual but could include names, dates of birth, Social Security numbers, driver's licence and state identification numbers and account details. For some people the data also covered medical claim information, provider and clinical details and health insurance information, which prompted a separate report to the US Department of Health and Human Services.
The company did not describe how the intruder got in, and no ransomware or extortion group claimed the attack. It said its investigation had confirmed the breach was confined to its own systems, that it had added safeguards, and that notified individuals were being offered free credit monitoring and identity restoration services.