2026 UltraMobile Imaging (Rochester, NY) — network disruption July 30; protected health information of about 75,000 people exposed
Data compromised
Demographics and contact details (names, home locations, phone numbers, birth dates, sex or gender); clinical details (diagnoses, lab results, prescribed drugs, service dates, study identifiers, procedure codes); provider and billing details (ordering doctors, treating sites, insurance claim records, financial account information). Some summaries also list Social Security and driver’s licence numbers; those are not confirmed in the notice text we read.
Technical writeup
The count of 75,000 individuals comes from HHS-derived trackers, after a September 25, 2026 HHS OCR filing; the notice became public around October 20, 2026. The HHS portal entry and the company notice were not retrieved directly. HIPAA Journal reports that individuals are now being notified, and plaintiff firms have announced investigations. companyConfirmed true (covered-entity filing).
Root cause
A network disruption on July 30, 2026 led to forensic confirmation that an unauthorised party had accessed parts of the network for a limited time. The notice does not say when the network was first compromised, and does not describe the entry route.