2025 Radiology Associates of Richmond — Jul 2025 intrusion; 266,183 notified (May 2026)
Data compromised
Protected health information of current/former patients; individual letters specify categories; Social Security numbers for a subset (credit monitoring offered)
Technical writeup
Verified healthcare breach — intrusion on or about July 25, 2025; Maine AG and patient notifications began May 21, 2026. Radiology Associates of Richmond (Virginia) said hackers accessed internal systems; an extensive forensic investigation and manual document review concluded April 6, 2026 that files containing protected health information were acquired without authorization. The practice started mailing notices May 21, 2026; Maine AG filing cites 266,183 individuals. Letters specify data types per person; those whose SSNs were in impacted files were offered complimentary credit monitoring. Distinct from RAR’s earlier April 2024 incident that HHS filings associated with ~1.4 million people.
Root cause
Unauthorized access to internal systems on or about July 25, 2025; forensic review concluded April 6, 2026 that PHI files were acquired
References
- https://rarichmond.com/notice-of-data-security-incident/
- https://www.hipaajournal.com/radiology-associates-of-richmond-data-breach/
- https://www.securityweek.com/266000-affected-by-data-breach-at-radiology-associates-of-richmond/
- https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/17198708-06ec-46f6-9f10-24f21f2e5549.html