What should I do if I was affected by this healthcare data breach?

If you were affected, monitor your credit reports and explanation of benefits statements for suspicious activity, take advantage of any free credit monitoring offered, consider freezing your credit, and document any unauthorized use of your health information. You may also be eligible to join a class action lawsuit for compensation.

How do I know if my data was included in this breach?

The breached organization is required by HIPAA to notify affected individuals within 60 days. Check your mail and email for breach notification letters. You can also contact the organization directly to ask if your records were affected. If the breach involved 500+ individuals, it is publicly reported to HHS and listed in their breach portal.

R&B Corporation of Virginia d/b/a Credit Control Corporation Data Breach

Credit Control Corp Network Server Breach Affects 345K

critical severityReported May 13, 2023HHS OCR VerifiedVirginia

What happened in the R&B Corporation of Virginia d/b/a Credit Control Corporation data breach?

The R&B Corporation of Virginia d/b/a Credit Control Corporation data breach was reported on May 13, 2023 and affected 345,523 individuals. The breach type was Hacking/IT Incident involving Network Server. This breach occurred in Virginia. Under HIPAA, affected patients must be notified within 60 days and may be entitled to credit monitoring services.

Harding Hall

345,523

Individuals Affected

Hacking/IT Incident

Breach Type

Network Server

Breach Location

Yes

Business Associate

Scale:Larger than 93% of healthcare breaches

3 years ago

HIPAA Category:hacking/IT incident

Visibility:national

R&B Corporation of Virginia d/b/a Credit Control Corporation Breach Details

Healthcare Data Breach Report: R&B Corporation of Virginia

Opening Summary

On May 13, 2023, R&B Corporation of Virginia, operating under the business name Credit Control Corporation, reported a significant data breach affecting 345,523 individuals. The breach resulted from unauthorized access to the organization's network server infrastructure, compromising protected health information (PHI) and other sensitive personal data. As a business associate to covered entities within the healthcare system, Credit Control Corporation's breach has cascading implications for multiple healthcare providers and their patients who utilize the company's services.

Company Response and Investigation

The discovery and response timeline for this breach reflects standard incident response protocols required under HIPAA Breach Notification Rule (45 CFR §§ 164.400-414). Upon discovering the unauthorized access to their network server, Credit Control Corporation initiated a comprehensive investigation to determine the scope of the breach, identify affected individuals, and assess what categories of information were compromised. The organization's security team worked to contain the breach, secure the affected systems, and preserve forensic evidence. The submission date of May 13, 2023, indicates the organization met its obligation to notify the Department of Health and Human Services (HHS) and affected individuals without unreasonable delay, typically within 60 days of discovery as mandated by HIPAA regulations.

Technical Details of the Breach

The breach occurred at the network server level, which typically represents a significant vulnerability in an organization's IT infrastructure. Network servers often contain centralized repositories of patient data, billing information, and administrative records. Unauthorized access to network servers can occur through various vectors including exploitation of unpatched software vulnerabilities, weak authentication credentials, phishing attacks targeting employee credentials, or compromised remote access points. The fact that this breach affected a business associate—an entity that handles PHI on behalf of covered entities—suggests the compromised servers likely contained data from multiple healthcare providers and their patients. Network-level breaches are particularly concerning because they may provide attackers with broad access to multiple data systems simultaneously, potentially exposing diverse categories of information across numerous patient records.

Organizational Context

Credit Control Corporation operates as a business associate within the healthcare ecosystem, typically providing services such as medical billing, accounts receivable management, insurance verification, or collection services on behalf of healthcare providers. The organization's Virginia-based operations suggest it may serve healthcare facilities throughout the Mid-Atlantic region and potentially beyond. As a business associate, Credit Control Corporation is subject to HIPAA Security Rule requirements (45 CFR Part 164, Subpart B) and must maintain appropriate administrative, physical, and technical safeguards to protect PHI. The scale of this breach—affecting over 345,000 individuals—indicates the organization likely processes data for multiple healthcare facilities or maintains historical records spanning several years of patient interactions.

Impact on Affected Individuals

The breach potentially exposed protected health information for 345,523 individuals, representing a substantial population of patients whose data was stored on the compromised network server. While the specific categories of PHI exposed are not detailed in the breach submission, individuals affected by breaches at business associates typically have their names, dates of birth, Social Security numbers, insurance information, medical record numbers, and clinical information at risk. Patients may have had their financial information, including banking details or credit card numbers used for payment processing, compromised. The notification process required Credit Control Corporation to contact all affected individuals, inform them of the breach, describe the types of information exposed, and provide guidance on protective measures. Affected patients should have received notification letters detailing the incident and offering complimentary credit monitoring or identity theft protection services, as is standard practice following breaches of this magnitude.

Industry Context and Risk Assessment

Network server breaches represent a significant category of healthcare data breaches, accounting for a substantial portion of reported incidents to HHS. According to HHS Office for Civil Rights (OCR) breach statistics, hacking and IT incidents consistently rank among the most common breach types affecting healthcare organizations and their business associates. The involvement of a business associate in this breach underscores the importance of supply chain security in healthcare—covered entities must ensure their business associates maintain adequate safeguards, and breaches at business associates trigger notification obligations for the covered entities they serve. HIPAA requires business associate agreements (BAAs) to include specific security and breach notification requirements. This incident likely triggered notifications from multiple covered entities to their patients, as healthcare providers must notify individuals when their PHI is breached by a business associate. The scale of this breach—exceeding 100,000 affected individuals—places it in the upper tier of healthcare data breaches and likely received attention from state regulators, the HHS Office for Civil Rights, and potentially law enforcement agencies investigating the unauthorized access.

What Data Was Exposed

Based on the business associate nature of Credit Control Corporation and typical network server breaches, the following categories of protected health information and personal data were likely exposed: - Patient names and contact information (addresses, phone numbers, email addresses) - Social Security numbers - Dates of birth - Medical record numbers and patient identification numbers - Health insurance information (policy numbers, group numbers, subscriber IDs) - Billing and payment information (credit card numbers, bank account details, routing numbers) - Clinical information and diagnoses - Treatment history and medical procedures - Prescription information - Provider names and facility information - Financial account information used for payment processing - Insurance claim details and explanation of benefits (EOB) information - Employment information - Emergency contact information

Risks to Patients

Individuals affected by this breach face multiple categories of risk: **Identity Theft Risk**: With Social Security numbers, dates of birth, and names exposed, attackers have the foundational information needed to commit identity theft, including opening fraudulent accounts, applying for credit, or filing false tax returns. **Financial Fraud**: Exposed credit card numbers, banking information, and financial account details create immediate risk of unauthorized transactions, fraudulent charges, and account takeovers. Patients may experience unauthorized withdrawals or charges appearing on their accounts. **Medical Identity Theft**: Criminals may use exposed medical information to obtain healthcare services under a victim's identity, potentially resulting in fraudulent medical bills, incorrect medical records, or insurance claim denials for services the victim did not receive. **Insurance Fraud**: With insurance policy numbers and subscriber information exposed, attackers may file fraudulent claims or manipulate existing claims, affecting patients' coverage and claims history. **Phishing and Social Engineering**: Exposed personal information may be used to craft convincing phishing emails or social engineering attacks targeting affected individuals, potentially leading to further credential compromise. **Privacy Violation**: The unauthorized access to sensitive health information represents a violation of patient privacy, with potential psychological impact and loss of confidentiality regarding sensitive medical conditions. **Long-term Monitoring Risk**: Exposed data may be sold on dark web marketplaces or used in future attacks, creating ongoing risk that extends years beyond the initial breach.

What to Do If You Were Affected by the R&B Corporation of Virginia d/b/a Credit Control Corporation Breach

Monitor credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) for unauthorized accounts or inquiries. Consider placing a fraud alert or credit freeze with each bureau to prevent unauthorized credit applications.
Review financial accounts, credit card statements, and bank statements for unauthorized transactions. Contact your financial institutions immediately if you identify suspicious activity, and consider changing passwords for all financial accounts.
Enroll in the complimentary credit monitoring and identity theft protection services offered by Credit Control Corporation or the affected healthcare providers. These services typically include credit monitoring, identity theft insurance, and fraud resolution assistance.
Monitor healthcare bills and explanation of benefits (EOB) statements for services you did not receive. Contact your healthcare providers and insurance company if you identify fraudulent claims or medical services billed to your account.
Consider placing a security freeze on your credit file with all three credit bureaus to prevent unauthorized access to your credit report. This requires contacting each bureau separately but provides strong protection against credit fraud.
Change passwords for any online healthcare portals, insurance portals, or accounts that may have been affected. Use strong, unique passwords and enable multi-factor authentication where available.
Be cautious of unsolicited communications claiming to be from healthcare providers, insurance companies, or financial institutions. Verify any requests for personal information by contacting the organization directly using a phone number or website you know to be legitimate.
File a report with the Federal Trade Commission (FTC) at IdentityTheft.gov if you believe your information has been misused. This creates an official record and provides a recovery plan.
Consider filing a police report if you experience identity theft or fraud, as this may be necessary for disputing fraudulent accounts or claims.
Retain all breach notification letters and documentation of the incident for your records, as you may need this information when disputing fraudulent accounts or claims.

Monitor Your Medical Records

Request copies to check for unauthorized changes

Check More Virginia Breaches

Search all breaches reported in Virginia

Were You Affected?

Patients affected by large healthcare data breaches may be eligible for compensation through class action lawsuits.

Learn about data breach lawsuits

Technical Notes

This breach involved unauthorized access to network server infrastructure, representing a significant technical compromise. Network servers typically function as centralized repositories for healthcare data and are critical components of healthcare IT infrastructure. Unauthorized access at the network server level suggests one or more of the following technical vulnerabilities or attack vectors: (1) exploitation of unpatched software vulnerabilities in server operating systems or applications; (2) compromise of administrative credentials through phishing, credential stuffing, or weak password practices; (3) exploitation of misconfigured network access controls or firewall rules; (4) compromise of remote access systems (VPN, RDP) used for legitimate administrative purposes; (5) insider threat or unauthorized access by individuals with legitimate system access; (6) supply chain compromise affecting software or hardware used in the network infrastructure. The fact that this breach affected a business associate handling healthcare data for multiple covered entities suggests the compromised servers contained data from numerous healthcare providers and potentially years of accumulated patient records. Network-level breaches are particularly concerning because they may provide attackers with access to multiple systems simultaneously and may go undetected for extended periods. The investigation likely involved forensic analysis of server logs, network traffic analysis, and assessment of access controls to determine the scope of unauthorized access and the specific data that was compromised. Remediation efforts would have included patching vulnerabilities, resetting compromised credentials, implementing enhanced monitoring and access controls, and potentially upgrading security infrastructure to prevent similar incidents.

Frequently Asked Questions

How many people were affected by the R&B Corporation of Virginia d/b/a Credit Control Corporation data breach?

The R&B Corporation of Virginia d/b/a Credit Control Corporation data breach affected 345,523 individuals. It was reported to the HHS Office for Civil Rights on May 13, 2023 and classified as a hacking/it incident incident in Virginia.

When was the R&B Corporation of Virginia d/b/a Credit Control Corporation breach reported?

The R&B Corporation of Virginia d/b/a Credit Control Corporation breach was reported to the U.S. Department of Health and Human Services Office for Civil Rights on May 13, 2023. Under HIPAA, covered entities must report breaches affecting 500 or more individuals within 60 days of discovery.

What type of breach occurred at R&B Corporation of Virginia d/b/a Credit Control Corporation?

The R&B Corporation of Virginia d/b/a Credit Control Corporation breach was classified as a "Hacking/IT Incident" incident involving "Network Server." This breach is rated critical severity based on the number of individuals affected and the type of data involved.

What data was exposed in the R&B Corporation of Virginia d/b/a Credit Control Corporation breach?

What should I do if I was affected by the R&B Corporation of Virginia d/b/a Credit Control Corporation data breach?

1. Monitor credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) for unauthorized accounts or inquiries. Consider placing a fraud alert or credit freeze with each bureau to prevent unauthorized credit applications. 2. Review financial accounts, credit card statements, and bank statements for unauthorized transactions. Contact your financial institutions immediately if you identify suspicious activity, and consider changing passwords for all financial accounts. 3. Enroll in the complimentary credit monitoring and identity theft protection services offered by Credit Control Corporation or the affected healthcare providers. These services typically include credit monitoring, identity theft insurance, and fraud resolution assistance. 4. Monitor healthcare bills and explanation of benefits (EOB) statements for services you did not receive. Contact your healthcare providers and insurance company if you identify fraudulent claims or medical services billed to your account. 5. Consider placing a security freeze on your credit file with all three credit bureaus to prevent unauthorized access to your credit report. This requires contacting each bureau separately but provides strong protection against credit fraud. 6. Change passwords for any online healthcare portals, insurance portals, or accounts that may have been affected. Use strong, unique passwords and enable multi-factor authentication where available. 7. Be cautious of unsolicited communications claiming to be from healthcare providers, insurance companies, or financial institutions. Verify any requests for personal information by contacting the organization directly using a phone number or website you know to be legitimate. 8. File a report with the Federal Trade Commission (FTC) at IdentityTheft.gov if you believe your information has been misused. This creates an official record and provides a recovery plan. 9. Consider filing a police report if you experience identity theft or fraud, as this may be necessary for disputing fraudulent accounts or claims. 10. Retain all breach notification letters and documentation of the incident for your records, as you may need this information when disputing fraudulent accounts or claims.

What are the risks to patients from the R&B Corporation of Virginia d/b/a Credit Control Corporation breach?

How do I file a HIPAA complaint about the R&B Corporation of Virginia d/b/a Credit Control Corporation breach?

You can file a HIPAA complaint with the HHS Office for Civil Rights (OCR) online at ocrportal.hhs.gov within 180 days of discovering the violation. The complaint must identify the covered entity (R&B Corporation of Virginia d/b/a Credit Control Corporation) and describe the acts or omissions you believe violated HIPAA. You can also contact OCR's toll-free hotline at 1-800-368-1019.

How can I check if I was affected by a healthcare data breach?

You can search for healthcare data breaches by provider name, state, or breach type using MedicalRecords.com's free Breach Check tool at medicalrecords.com/breach-check. The tool searches 1,638 breaches reported to the HHS Office for Civil Rights. Covered entities are also required to notify affected individuals directly.