Catalyst Physician Group

A single compromised login let an unauthorized actor into a Catalyst RCM server over November 8 and 9, 2025, with no phishing lure or exploited flaw named, just a credential that should not have worked. Catalyst RCM processes billing and revenue cycle data for multiple healthcare clients, including Catalyst Physician Group and the lab now known as Vanta Diagnostics, so one login opened files belonging to entities that never chose that vendor's security posture. Personal details, medical data, and insurance information moved together because the billing pipeline treated them as one bundle worth protecting equally, which it wasn't. It took Catalyst nearly 10 months to report the incident, and they graciously give you only 3 months to sign up for identity protection. 3x less time for you to respond than it took them to respond.