Loading story…
SimonMed Imaging, one of the largest outpatient medical imaging providers in the United States, experienced a significant data breach following a ransomware attack by the Medusa group. The incident resulted in unauthorized access to SimonMed’s systems between January 21 and February 5, 2025, as confirmed by both company statements and regulatory filings. The breach was initially discovered on January 27, 2025, after a vendor notified SimonMed of a security incident, prompting an immediate internal investigation. The attackers reportedly stole approximately 200 GB of data, impacting over 1.2 million individuals whose sensitive information was exposed. SimonMed Imaging provides a wide range of diagnostic services, including MRI, CT, X-ray, ultrasound, mammography, PET, nuclear medicine, bone density, and interventional radiology, and operates around 170 medical centers across 11 states. The compromised data includes names, addresses, birth dates, dates of service, and provider names, with the potential for even more sensitive medical information to have been accessed, given the nature of the business. In response to the breach, SimonMed took several remediation steps, such as resetting passwords, strengthening multi-factor authentication, implementing enhanced endpoint detection and response monitoring, removing direct vendor access, and restricting network traffic to trusted connections. The company also engaged data security and privacy professionals and notified law enforcement authorities. As of October 10, 2025, SimonMed stated there was no evidence that the stolen information had been misused for identity theft or fraud. The company emphasized that the investigation is ongoing to determine the full scope of the data affected. The breach highlights the persistent threat of ransomware attacks targeting healthcare organizations, which often store large volumes of sensitive patient data. SimonMed’s swift response included notifying affected individuals and regulatory bodies, as required by law. The Medusa ransomware group’s involvement underscores the increasing sophistication and impact of cybercriminal operations against critical healthcare infrastructure. The incident has raised concerns about third-party vendor security, as the initial alert came from an external partner experiencing its own security issues. SimonMed’s annual revenue exceeds $500 million, and the scale of this breach is among the largest in the healthcare sector for 2025. The company continues to monitor for any signs of misuse of the compromised data and is providing support to affected individuals. This event serves as a stark reminder of the importance of robust cybersecurity measures and incident response planning in the healthcare industry.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
In October 2025, SimonMed Imaging publicly disclosed that the January breach affected over 1.2 million individuals. Reports described the incident as impacting roughly 1.2 million patients and drew attention to the scale of the exposure.
SimonMed Imaging said a data breach occurred in January 2025, exposing patient information. Later reporting tied the incident to a breach claimed by the Medusa ransomware operation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SimonMed Imaging and Doctors Imaging Group, two major radiology practices in the United States, have reported significant data breaches impacting nearly 1.5 million individuals. The cybercrime group known as Medusa has claimed responsibility for the attack on SimonMed Imaging, which occurred in January. Initially, SimonMed reported the breach to federal authorities with a placeholder estimate of 500 affected individuals, but later filings with the Maine attorney general revealed the true scope, with nearly 1.28 million patients impacted. The compromised data reportedly includes highly sensitive health information, such as a spreadsheet containing records of over 1 million mammograms performed by SimonMed. Medusa threatened to leak the stolen data on the dark web, escalating concerns about patient privacy and potential misuse of the information. The breach has already led to at least four proposed federal class action lawsuits against SimonMed, with plaintiffs alleging inadequate protection of patient data and highlighting the cybercriminal gang's public claims of exfiltrating 212 gigabytes of data. Doctors Imaging Group was also affected by a separate hacking incident, contributing to the total number of nearly 1.5 million individuals notified. Both organizations have begun notifying affected patients, as required by law, and are working with authorities to investigate the incidents. The attacks underscore the ongoing threat posed by ransomware and data extortion groups targeting healthcare providers, who often hold large volumes of sensitive personal and medical information. The Medusa group’s tactics include not only stealing data but also threatening public exposure to pressure victims into paying ransoms. The breach at SimonMed has drawn attention from regulators and the legal community, with scrutiny over the timeliness and accuracy of breach notifications. The incident highlights the importance of robust cybersecurity measures and incident response planning in the healthcare sector. Both radiology practices are likely to face increased regulatory oversight and potential financial penalties as investigations continue. The exposure of mammogram records and other health data raises significant concerns about patient safety, identity theft, and fraud. Healthcare organizations are being urged to review their security postures and ensure compliance with data protection regulations in light of these breaches. The Medusa group’s involvement in these attacks is part of a broader trend of cybercriminals targeting critical infrastructure and healthcare entities for financial gain.
Jun 29, 2026
Multiple U.S. healthcare organizations have recently disclosed data breaches resulting from unauthorized access to sensitive patient information. Expert MRI, a radiology provider in California, reported that an attacker accessed its network between June and August 2025, exfiltrating data such as names, addresses, dates of birth, diagnoses, and, for some, Social Security numbers. The PEAR threat group claimed responsibility and briefly listed stolen data on its leak site, suggesting a ransom may have been paid. Revere Health in Utah experienced a breach of a third-party payment platform, potentially exposing patient names, dates of birth, addresses, medical record numbers, and partial Social Security numbers, though no evidence of misuse was found. Health Management Systems of America in Michigan disclosed a breach after an employee fell victim to a spear phishing attack, resulting in the unauthorized download of emails containing patient data. These incidents highlight the ongoing risks faced by healthcare organizations from both targeted ransomware groups and opportunistic phishing attacks. In response, affected providers have reported the breaches to regulators, enhanced their cybersecurity measures, and offered credit monitoring to impacted individuals. The number of affected patients varies by incident, with Revere Health reporting up to 10,800 impacted and Expert MRI yet to disclose a total. The breaches underscore the importance of robust security practices and employee awareness training to mitigate the risk of data compromise in the healthcare sector.
Jun 29, 2026
**University of Mississippi Medical Center (UMMC)** is facing an extortion threat after the **Medusa** ransomware gang claimed responsibility for the February cyberattack that disrupted hospital operations and forced staff to rely on paper processes and other offline workarounds. The incident affected one of Mississippi’s most critical healthcare providers, with hospitals and emergency departments remaining open while **35 clinic locations** were closed; recovery involved assistance from the **FBI** and **Department of Homeland Security**, and full reopening was reported on March 2. Medusa later posted on its leak site that it had stolen data from UMMC and demanded **$800,000**, with a deadline of **March 20**. Reporting indicates the gang offered multiple extortion options, including paying to delete the data, buying the allegedly stolen information, or paying a smaller amount to extend the deadline. Screenshots were published as purported proof of theft, but UMMC had not confirmed that sensitive patient or enterprise data was actually exfiltrated, and the size and scope of the alleged data set remained unclear at the time of reporting.
Jun 29, 2026