Ransomware attack on US healthcare debt collector exposes 1.9m patient records