hiveleak attacks MAS & Coronis Health

Incident Date:

February 25, 2022

World map



hiveleak attacks MAS & Coronis Health


MAS & Coronis Health




Frederick, USA

Marryland, USA

First Reported

February 25, 2022

MAS & Coronis Health Suffers Ransomware Attack by Hiveleak Group

Company Overview

Coronis Health is a leading medical billing company that offers a range of services to healthcare providers, including data-driven, proprietary methods to accelerate payments and enable providers to focus on care delivery. They have been in operation for over three years and have a reputation for transparency and thoroughness in their billing process.

Vulnerabilities and Threats

The attack on Coronis Health highlights the ongoing threat of ransomware attacks in the healthcare sector. In 2023, nearly 90 million individuals were affected by large breaches, up from 55 million individuals affected in 2022. Hospitals and healthcare providers must invest in robust cybersecurity measures to protect their systems and sensitive patient data from such attacks.

Previous Cybersecurity Incidents

Coronis Health has faced previous cybersecurity incidents, including a phishing attack that led to a breach of electronic protected health information (ePHI) in 2021. The Office for Civil Rights (OCR) investigated the case and found that the group had failed to conduct a risk analysis to identify potential threats or vulnerabilities to ePHI across the organization.

Mitigation Strategies

To mitigate the risks of ransomware attacks, healthcare providers should regularly review their information system activity, establish and implement security measures to reduce security risks and vulnerabilities to ePHI, and provide training to staff members on HIPAA policies and procedures.

The ransomware attack on MAS & Coronis Health underscores the importance of robust cybersecurity measures in the healthcare sector. Healthcare providers must remain vigilant and proactive in protecting their systems and sensitive patient data from cyber threats.


  • Coronis Health: Top Medical Billing Company & Outsourcing | Coronis Health
  • Gone Phishing: Medical Group Penalized in Wake of Cyberattack
  • Sentara Health notifying 741 patients after mistake by Coronis Health employee
  • Under Attack: Hospitals Face New Cybersecurity Threats | Coronis
  • Global ransomware attack and how to stay protected - Coronis Health
  • Cyber Attack against Change Healthcare - Coronis Health

Recent Ransomware Attacks

The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.

The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.