Loading story…
Radiology Associates of Richmond said threat actors gained unauthorized access to its internal systems on or about July 25, 2025, leading to the potential viewing or acquisition of files containing electronic personal information and protected health information for 266,183 individuals. After a forensic investigation and manual document review concluded on April 6, 2026, the Virginia-based imaging provider determined the exposed data may include names, Social Security numbers, government-issued ID numbers, financial account information, medical records, health insurance details, and possibly payment card data.
The provider said it engaged external cybersecurity specialists to contain the intrusion and assess its scope, and began mailing notification letters to affected individuals on May 21, 2026. People whose Social Security numbers were involved were offered complimentary credit monitoring and identity theft protection services. The disclosure marks the organization's second major cybersecurity incident in a short period, following a separate breach tied to an April 2024 event that affected roughly 1.4 million individuals.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The organization publicly disclosed the breach in filings and notices in May 2026, reporting that 266,183 individuals were affected. This marked the company's second major disclosed breach in a short period, following a separate incident previously tied to April 2024.
Radiology Associates of Richmond began mailing breach notification letters on May 21, 2026 to 266,183 affected individuals. The organization offered complimentary credit monitoring and identity theft protection to people whose Social Security numbers were exposed.
By April 6, 2026, a forensic investigation and manual document review had concluded that files containing personal and protected health information were affected. Reported data types included names, Social Security numbers, government IDs, financial account details, medical records, insurance information, and possibly payment card data.
Threat actors gained unauthorized access to Radiology Associates of Richmond's internal systems on or about July 25, 2025. The intrusion led to unauthorized acquisition or potential viewing of files containing protected health information and other sensitive personal data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple U.S. healthcare organizations have recently disclosed data breaches resulting from unauthorized access to sensitive patient information. Expert MRI, a radiology provider in California, reported that an attacker accessed its network between June and August 2025, exfiltrating data such as names, addresses, dates of birth, diagnoses, and, for some, Social Security numbers. The PEAR threat group claimed responsibility and briefly listed stolen data on its leak site, suggesting a ransom may have been paid. Revere Health in Utah experienced a breach of a third-party payment platform, potentially exposing patient names, dates of birth, addresses, medical record numbers, and partial Social Security numbers, though no evidence of misuse was found. Health Management Systems of America in Michigan disclosed a breach after an employee fell victim to a spear phishing attack, resulting in the unauthorized download of emails containing patient data. These incidents highlight the ongoing risks faced by healthcare organizations from both targeted ransomware groups and opportunistic phishing attacks. In response, affected providers have reported the breaches to regulators, enhanced their cybersecurity measures, and offered credit monitoring to impacted individuals. The number of affected patients varies by incident, with Revere Health reporting up to 10,800 impacted and Expert MRI yet to disclose a total. The breaches underscore the importance of robust security practices and employee awareness training to mitigate the risk of data compromise in the healthcare sector.
Jun 29, 2026
Medical Computer Business Services (MCBS), a Georgia-based medical billing and practice-management firm, disclosed that a September 2025 network intrusion exposed the personal, insurance, and medical information of **1,261,464 individuals**. The company said unauthorized actors accessed its systems between **September 22 and September 26, 2025**, and that the compromised data may include names, addresses, Social Security numbers, dates of birth, insurance identifiers, medical histories, diagnoses, and treatment details. MCBS reported that the affected records were tied to data it managed for **seven healthcare organizations**. The incident has been linked to the **PEAR ransomware** group, which claimed responsibility shortly after the intrusion and alleged it stole more than **3 TB** of data, including patient `PII`/`PHI`, financial records, HR documents, payment information, and emails. MCBS said its investigation concluded on **May 28, 2026**, while U.S. Department of Health and Human Services breach-tracker data lists the event among major healthcare breaches, underscoring the scale of the exposure and the risk to patients and partner providers.
Jul 30, 2026
Brown Health Medical Group-MA disclosed a data breach affecting **311,760 individuals** after unauthorized activity was discovered on a legacy file server at its Hawthorn location in December 2025. The organization said the intrusion was limited to that historic file server and did **not** affect its electronic medical record or electronic health record systems, but a June 22, 2026 review found that files on the server had been accessed. The exposed information potentially included names, contact details, dates of birth, Social Security numbers, driver’s license and other government ID numbers, medical and disability records, financial account information, payment card data, and employment-related records. Brown Health Medical Group-MA reported the incident to the **HHS Office for Civil Rights** and state authorities in Massachusetts and Vermont, said no threat actor had been publicly identified or linked to a ransomware or extortion claim, and is offering affected individuals **24 months** of credit monitoring, fraud detection, and identity theft protection services.
Aug 6, 2026