The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Professional Finance Company (PFC USA), a debt-collection and accounts-receivable company serving healthcare providers, suffered a ransomware-related data-security incident in February 2022. Information held for patients and others connected to its clients may have been exposed. A later Indiana Attorney General filing listed 1,972,699 affected individuals, while a SecurityWeek report described 657 entries on PFC’s affected-provider list. The class-action settlement’s claim deadline was April 25, 2025, and has passed.
What happened in the PFC USA data breach?
Professional Finance Company, Inc., also known as PFC USA, handled accounts receivable and collection work for healthcare providers and other organizations. In February 2022, unauthorized parties accessed PFC systems during an incident described in contemporaneous reporting as ransomware. SecurityWeek reported that some computers were accessed and disabled. PFC’s public notice said information stored on its systems may have been compromised; that does not establish that every record was viewed, copied, or misused.
PFC said it began notifying potentially affected healthcare-provider clients on May 5, 2022, and announced individual notifications on July 1. SecurityWeek reported on July 5 that notices were being sent to people connected to more than 650 providers. PFC’s notice and SecurityWeek’s report describe the incident and notification timeline.
How many providers and people were affected?
| Measure | Reported figure | What it means |
|---|---|---|
| Provider-list entries | 657 entries, according to SecurityWeek | The list entries should not automatically be treated as 657 separate healthcare systems or as proof that every patient of every listed provider was affected. |
| Individuals | 1,972,699, listed in an Indiana Attorney General breach report | This is the count in the government filing, not an exact total that PFC’s July notice publicly confirmed. |
The figures count different things: provider-list entries and individuals. The Indiana filing gives a notification date of May 3, 2022. See the Indiana Attorney General’s breach report. The count should be attributed to that filing rather than stated as an independently confirmed PFC total.
Recommended Free Tools
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What information may have been exposed?
Potentially affected information varied by person. SecurityWeek reported that it could include:
- Name, mailing address, and date of birth.
- Social Security number.
- Health-insurance information and medical-treatment information.
- Accounts-receivable balance and payment information.
These are possible categories, not a claim that every person’s information included every item. The incident does not by itself show that data was used for identity theft or sold.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why might a patient receive a letter from PFC?
A patient may have had no direct relationship with PFC. A hospital, clinic, physician group, laboratory, or other healthcare organization may have used PFC to manage billing, accounts receivable, or collections. In that arrangement, PFC could hold account and related personal information on the provider’s behalf, so a notice may come from a company the patient does not recognize.
What happened in the PFC data-breach lawsuit?
The federal case, Rodriguez v. Professional Finance Co. Inc., Case No. 1:22-cv-01679-RMR-STV, concerned the February 2022 incident. Plaintiffs alleged that unauthorized parties accessed their information and brought claims including negligence, breach of implied contract, breach of third-party-beneficiary contract, unjust enrichment, invasion of privacy, and statutory consumer-protection claims. Those were allegations, not findings that the claims were proven.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The parties reached a $2.5 million non-reversionary settlement. PFC denied liability and wrongdoing; settlement is not an admission. The settlement FAQ explains the case and allegations, and the official settlement documents include the agreement and court orders.
Can you still file a settlement claim?
No ordinary claim period remains open. The court-authorized settlement website lists April 25, 2025, as the deadline for online or mailed claim forms. That date has passed. The site remains useful for checking the case, reviewing documents, and finding official contact details, but its continued availability does not mean a new claim can ordinarily be filed. Do not assume a late claim will be accepted.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should affected people do now?
- Find and verify the notice. Check the original letter and compare its case details with the official settlement website. The site lists 833-627-7416 as its contact number. Navigate to the site yourself rather than following an unsolicited message link.
- Review your credit reports. Look for unfamiliar accounts, collection activity, address changes, and hard inquiries. AnnualCreditReport.com is the federally authorized source for free credit reports.
- Consider a credit freeze. A freeze restricts access to your credit file unless you lift it; it can make it harder for someone to open new credit in your name. Set one up with each bureau: Equifax, Experian, and TransUnion. A freeze does not stop every kind of medical, tax, payment, or account fraud.
- Check medical and insurance records. Review explanations of benefits, bills, provider records, prescriptions, and claims for unfamiliar services or changes. Contact your insurer or provider directly if something looks wrong.
- Secure accounts that reuse passwords. Change reused passwords, especially for email, banking, insurance, and patient portals, and enable multifactor authentication where available.
- Report suspected identity theft. Use the Federal Trade Commission’s IdentityTheft.gov recovery guidance and contact financial institutions using independently verified contact details.
- Keep debt questions separate from breach questions. Do not pay an alleged PFC-related debt solely because you received a breach notice. Verify a debt and its collector independently; exposure of information does not establish whether a debt is valid.
How to avoid breach-related scams
People searching for a settlement or responding to an old notice may be targeted by impersonators. Be cautious of unsolicited calls, texts, or emails that demand immediate payment, request bank details or a Social Security number, or promise settlement money in exchange for a fee. Caller ID can be spoofed. Confirm any communication through the court-authorized website or its published phone number, and do not treat a live website as proof that claims are still being accepted.
What the incident shows about healthcare vendors
Healthcare information can be held not only by hospitals and clinics but also by billing, collection, and other service providers. A vendor incident can therefore affect people whose primary relationship is with a healthcare provider. The presence of health-related information does not, on its own, establish a HIPAA violation; that depends on the entities and obligations involved and on legal or regulatory findings. HHS explains breach reporting through its Breach Portal.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
