Loading story…
Doctors Imaging Group, a Florida-based provider of medical scanning services such as MRI and X-ray imaging, experienced a significant data breach in November 2024 that resulted in the theft of sensitive information belonging to 171,862 patients. The breach was not publicly disclosed until nearly a year later, after the company completed its internal investigation on August 29, 2025, and subsequently notified the Department of Health and Human Services. The compromised data included a wide range of personally identifiable information (PII), such as names, addresses, dates of birth, and Social Security numbers. In addition to PII, the attackers accessed financial account numbers and types, patient account numbers, medical record numbers, health insurance details, and information related to medical treatments and insurance claims. The nature of the attack has not been specified by Doctors Imaging Group, and no known ransomware group or cybercrime operation has claimed responsibility for the incident. The breach was discovered after suspicious activity was detected on the network, prompting a swift response from the organization to investigate and secure their systems. Federal law enforcement and relevant regulatory authorities were notified as part of the incident response process. Affected individuals were informed via mailed letters, provided their address information was available, and the company has committed to reviewing and enhancing its cybersecurity policies and tools to prevent future incidents. The breach is notable for the breadth and sensitivity of the data exposed, which could be exploited for identity theft, financial fraud, or insurance fraud. The incident occurred during a period when several other healthcare organizations in the region, including Medical Associates of Brevard and Wayne Memorial Hospital, also reported significant data breaches, highlighting a broader trend of cyberattacks targeting the healthcare sector. Despite the scale of the breach, there is no public evidence that the stolen data has been misused or leaked by the attackers as of the time of disclosure. The delay in notification has raised concerns about the timeliness of breach disclosures in the healthcare industry, especially given the potential risks to affected patients. Doctors Imaging Group has reiterated its commitment to information security and is taking steps to strengthen its defenses in response to the incident. The breach underscores the ongoing vulnerability of healthcare providers to cyberattacks and the critical importance of robust data protection measures. Patients affected by the breach are advised to monitor their financial and medical accounts for signs of misuse. The incident serves as a reminder of the high value of medical and financial data on the black market and the persistent threat posed by cybercriminals to the healthcare sector.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
After investigating the breach, Doctors Imaging Group concluded that patient information had been compromised. Reporting in October 2025 said more than 171,000 people were affected.
Doctors Imaging Group was attacked in late 2024, beginning an incident that disrupted the medical imaging business and led to a later investigation into possible data theft. The attack occurred roughly 10 months before the October 2025 reporting.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SimonMed Imaging and Doctors Imaging Group, two major radiology practices in the United States, have reported significant data breaches impacting nearly 1.5 million individuals. The cybercrime group known as Medusa has claimed responsibility for the attack on SimonMed Imaging, which occurred in January. Initially, SimonMed reported the breach to federal authorities with a placeholder estimate of 500 affected individuals, but later filings with the Maine attorney general revealed the true scope, with nearly 1.28 million patients impacted. The compromised data reportedly includes highly sensitive health information, such as a spreadsheet containing records of over 1 million mammograms performed by SimonMed. Medusa threatened to leak the stolen data on the dark web, escalating concerns about patient privacy and potential misuse of the information. The breach has already led to at least four proposed federal class action lawsuits against SimonMed, with plaintiffs alleging inadequate protection of patient data and highlighting the cybercriminal gang's public claims of exfiltrating 212 gigabytes of data. Doctors Imaging Group was also affected by a separate hacking incident, contributing to the total number of nearly 1.5 million individuals notified. Both organizations have begun notifying affected patients, as required by law, and are working with authorities to investigate the incidents. The attacks underscore the ongoing threat posed by ransomware and data extortion groups targeting healthcare providers, who often hold large volumes of sensitive personal and medical information. The Medusa group’s tactics include not only stealing data but also threatening public exposure to pressure victims into paying ransoms. The breach at SimonMed has drawn attention from regulators and the legal community, with scrutiny over the timeliness and accuracy of breach notifications. The incident highlights the importance of robust cybersecurity measures and incident response planning in the healthcare sector. Both radiology practices are likely to face increased regulatory oversight and potential financial penalties as investigations continue. The exposure of mammogram records and other health data raises significant concerns about patient safety, identity theft, and fraud. Healthcare organizations are being urged to review their security postures and ensure compliance with data protection regulations in light of these breaches. The Medusa group’s involvement in these attacks is part of a broader trend of cybercriminals targeting critical infrastructure and healthcare entities for financial gain.
Jun 29, 2026
Multiple U.S. healthcare organizations have recently disclosed data breaches resulting from unauthorized access to sensitive patient information. Expert MRI, a radiology provider in California, reported that an attacker accessed its network between June and August 2025, exfiltrating data such as names, addresses, dates of birth, diagnoses, and, for some, Social Security numbers. The PEAR threat group claimed responsibility and briefly listed stolen data on its leak site, suggesting a ransom may have been paid. Revere Health in Utah experienced a breach of a third-party payment platform, potentially exposing patient names, dates of birth, addresses, medical record numbers, and partial Social Security numbers, though no evidence of misuse was found. Health Management Systems of America in Michigan disclosed a breach after an employee fell victim to a spear phishing attack, resulting in the unauthorized download of emails containing patient data. These incidents highlight the ongoing risks faced by healthcare organizations from both targeted ransomware groups and opportunistic phishing attacks. In response, affected providers have reported the breaches to regulators, enhanced their cybersecurity measures, and offered credit monitoring to impacted individuals. The number of affected patients varies by incident, with Revere Health reporting up to 10,800 impacted and Expert MRI yet to disclose a total. The breaches underscore the importance of robust security practices and employee awareness training to mitigate the risk of data compromise in the healthcare sector.
Jun 29, 2026
Healthcare Interactive, a company specializing in AI-driven medical insurance benefit enrollment and billing solutions, confirmed a significant data breach that resulted in the exfiltration of sensitive customer data by hackers. The compromised information included names, dates of birth, Social Security numbers, contact details, health insurance enrollment data, patient diagnoses, provider names, lab results, medical images, and treatment plans. The breach also involved medical claims data, such as account numbers and billing codes. The incident occurred between July 8 and July 12, 2025, but was only detected around July 22, prompting the company to notify regulators and launch an internal investigation. The method of intrusion was not disclosed, leaving uncertainty about whether social engineering or phishing was involved. In a separate but related trend, Allianz Life, a major American insurance provider, reported a data breach in July 2025 that affected nearly 1.5 million individuals, including customers, financial professionals, and employees. The breach was traced to unauthorized access of a third-party cloud-based CRM system, with the ShinyHunters extortion group suspected to be behind the attack. Exposed data included names, addresses, dates of birth, and Social Security numbers, though earlier reports suggested additional information such as email addresses and phone numbers may have been compromised. Allianz Life has since notified affected individuals and authorities, and provided instructions for protective measures. Another incident involved ClaimPix, an Illinois-based auto insurance claims platform, where a misconfigured and unencrypted database exposed over 5.1 million files, totaling 10.7 terabytes of data. The exposed records included personal identifiable information, insurance documents, vehicle registrations, repair invoices, and images of damaged vehicles, as well as sensitive Power of Attorney documents that could facilitate fraud or impersonation. Archer Health, a U.S. provider of palliative and in-home care services, also suffered a data exposure due to a misconfigured database, leaking nearly 145,000 health records containing names, Social Security numbers, diagnostic details, and treatment plans. The company responded by securing the database and initiating an investigation, though it remains unclear if the data was accessed by malicious actors. These incidents collectively highlight a pattern of significant data breaches affecting the insurance and healthcare sectors, often involving misconfigured cloud storage or third-party service vulnerabilities. The breaches have exposed millions of individuals' sensitive personal and health information, raising concerns about the adequacy of cybersecurity measures in these industries. Regulatory notifications and investigations have been initiated in each case, but the full impact on affected individuals and organizations is still being assessed. The incidents underscore the critical need for robust data protection, regular security audits, and stringent oversight of third-party service providers. The exposure of highly sensitive data, including medical diagnoses and legal documents, increases the risk of identity theft, fraud, and other malicious activities. Organizations are urged to review their cloud security configurations and incident response protocols to prevent similar breaches. The healthcare and insurance sectors remain prime targets for cybercriminals due to the value of the data they hold. These breaches serve as a stark reminder of the evolving threat landscape and the importance of proactive cybersecurity strategies.
Jun 29, 2026