October 20, 2026: UltraMobile Imaging, a mobile diagnostic imaging provider in Rochester, New York, reported that the protected health information of about 75,000 people was exposed after a network disruption on July 30, 2026. Canonical record: ultramobile-imaging2026. Coverage that reports the notice: HIPAA Journal.
Imaging providers hold a dense mix of data: who was scanned, why, which doctor ordered the test, and how it was billed. A breach of that kind can expose a patient’s diagnosis, their insurer and their payment details in a single file. This post explains what is confirmed, what is still open, and what patients can do.
What happened
- July 30, 2026: A network disruption affected some computer systems at UltraMobile Imaging.
- Forensic review: Forensic experts confirmed that an unauthorised party had accessed parts of the network for a limited time. The notice does not say when the network was first compromised.
- September 25, 2026: The breach was reported to the US Department of Health and Human Services Office for Civil Rights, according to HHS-derived trackers.
- About October 20, 2026: The notice became public. HIPAA Journal reports that affected individuals are now being notified.
What was exposed
The notice covers several categories of data. Demographic and contact details include names, home locations, phone numbers, birth dates, and sex or gender. Clinical details include diagnoses, lab results, prescribed drugs, service dates, study identifiers and procedure codes. Provider and billing details include the names of ordering doctors, the treating sites, insurance claim records and financial account information.
Some summaries also list Social Security numbers and driver’s licence numbers. Those fields are not confirmed in the notice text we read, so treat them as unverified until the full notice is checked.
Why the timing matters
The network disruption on July 30 and the public notice on or around October 20 are about twelve weeks apart. The notice does not say when the network was first compromised, so the unauthorised access may have started before the disruption. For patients, the practical point is that records from before July 30 may also be in scope.
What a patient should expect
A notice of this kind usually explains what was involved and what the provider is doing about it, and it may describe how to enroll in any monitoring offered. Patients who receive a letter should read it for the categories named, because those categories show what could be used against them. A diagnosis or medication list is most useful to someone trying to pass as you with an insurer, so insurance statements are the first place to look.
Verified vs unverified
- Verified (covered-entity notice, as reported): a network disruption on July 30; unauthorised access to parts of the network for a limited time; the categories of data listed above.
- Reported by trackers: about 75,000 individuals, from HHS-derived data after a September 25 filing. We did not retrieve the HHS portal entry directly.
- Not known: when the network was first compromised, how the attackers got in, whether the data has been published, and whether Social Security or driver’s licence numbers are included.
Who is at risk
Patients who had imaging at UltraMobile Imaging are the main group at risk. A diagnosis or lab result is hard to change once it is out, and it can be used in targeted scams that refer to a real scan or a real doctor. Financial account details in billing records also mean bank alerts are worth turning on.
What to do
- Read the notice when it arrives. Follow its steps, and enroll in any monitoring it offers.
- Check insurance statements for services you did not receive. Medical identity theft often shows up first as a claim you do not recognise.
- Ask your provider for your records if you think they may be wrong, and ask for an accounting of disclosures if you want to know who received your information.
- Turn on account alerts with your bank if financial details were in your billing records.
- Be cautious with calls that mention an imaging appointment or results and ask for your Social Security number or a payment. A provider should not need either to discuss a scan with you.
- Consider a credit freeze if your Social Security number is in the records you were sent.
Context
Health data does not expire the way a card does. A diagnosis from 2026 is still sensitive in 2036, which is why medical-record breaches stay useful to criminals long after the first notice. The Moldova health-insurance cyberattack earlier this year shows the same risk at national scale (see our Moldova CNAM post).
Plaintiff law firms have announced investigations into the incident. That is a solicitation rather than a finding about fault, and you do not need to respond to it to protect yourself or your records.
Sources
Related reading
- Moldova’s CNAM health-insurance cyberattack: a health-data incident with the same kind of risk to insurance records.