Mid Michigan Medical Billing Service Data Breach Investigation

Recently, MMMBS announced that it had experienced a data breach in which sensitive personal identifiable information and protected health information in its care may have been compromised. According to the breach notice shared on its website, MMMBS became aware of suspicious activity involving its IT network.¹ As a result, MMMBS launched an investigation to determine the nature of the incident.

Through its investigation, MMMBS confirmed that sensitive personal information in its systems may have been accessed and acquired by an unauthorized third party on March 27, 2025. As a result, MMMBS began a review of the data to determine what information had been impacted as well as identify the specific individuals affected. On December 2, 2025, MMMBS completed this review. While the information impacted varies depending on the individual, the type of information potentially exposed includes:

• Name
• Social Security number
• Date of birth
• Driver’s license or government issued identification number
• Medicare/Medicaid identification number
• Diagnosis/treatment information
• Medical record number/patient account number
• Health insurance information
• Payment card number
• Employer identification number
• Passport number
• Treating/referring provider name
• Biometric data

On January 2, 2026, MMMBS posted notice of the breach on its website. Additionally, on January 5, 2026, MMMBS filed official notice of the data breach with the U.S. Department of Health and Human Services’ Office for Civil Rights.⁴ Based on the website breach notice, MMMBS is providing affected individuals with a list of the specific types of sensitive information impacted and complimentary credit monitoring services. A link to the website breach notice is below.