2 Radiology Practices Notifying Nearly 1.5 Million of Hacks

Two radiology practices are notifying nearly 1.5 million people of separate hacking incidents compromising their sensitive health information. Cybercrime gang Medusa claimed credit for attacking Arizona-based SimonMed Imaging in January and threatened to leak the stolen data of nearly 1.3 million patients on the darkweb.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

SimonMed first reported the breach to federal authorities on March 27 as affecting 500 people – a placeholder estimate – and on Friday, the firm filed a breach report to Maine’s attorney general indicating the hack actually affected nearly 1.28 million people.

The breach was already the subject of at least four proposed federal class action lawsuits filed against SimonMed, with some alleging that cybercriminal gang Medusa on its dark website in early February claimed to have exfiltrated 212 gigabytes of data from SimonMed’s IT systems, including a spreadsheet with records of over 1 million mammograms SimonMed conducted on patients.

Medusa also allegedly threatened to publish the entire trove of information compromised in the data breach to its darkweb leak site if SimonMed did not comply with its ransom demands by Feb. 21, the lawsuit alleged. As of Monday, Medusa’s darkweb leak site did not appear to contain a listing for SimonMed’s data.

SimonMed did not immediately respond to Information Security Media Group’s request for additional details about the hacking incident and interactions with Medusa.

The Russian-speaking Medusa group, which typically uses triple extortion attacks to pressure victims into paying the ransom, has been the subject of government and healthcare industry warnings. (see: Medusa Ransomware Turns Critical Infrastructure to Stone).

A joint alert in March from the Cybersecurity Infrastructure and Security Agency, FBI and Multi State Information Sharing and Analysis Center – as well as a related alert specifically for the healthcare sector by the American Hospital Association – warned of Medusa attacks.

But Medusa’s victims range well beyond healthcare, claiming hacks in manufacturing, technology, government and other sectors.

Florida Radiology Practice Hack

Another radiology practice also recently reported a major hack, Florida-based Doctors Imaging Group, which told federal regulators on Sept. 24 that someone hacked a network server and affected nearly 172,000 individuals.

Doctors Imaging Group in a breach notice posted on its website said “unknown actors” accessed and copied files from the organization’s network between Nov. 5 and Nov. 11, 2024.

The information contained in the compromised files included name, address, date of birth, admission date, financial account number, financial account type, patient account number, medical record number, health insurance information, medical treatment information, medical claim information and Social Security number.

Doctors Imaging Group said it reported the hacking incident to federal law enforcement. “As part of our ongoing commitment to information security, we are currently reviewing our policies and procedures, as well as assessing new cybersecurity tools, to reduce the risk of a similar incident from occurring in the future,” the practice said in its breach notice.

Doctors Imaging Group did not immediately respond to ISMG’s request for additional details about the data breach.

Similar Radiology Hacks

Doctors Imaging Group and SimonMed are among many radiology practices hit by cyberattacks in recent years. Those incidents have resulted in numerous major health data compromises and often in serious disruptions to patient care.

Shortly after the SimonMed hack, attackers hit Miami, Florida-based Vital Imaging Medical Diagnostic Centers in February. The company operates eight medical imaging and testing facilities in the region and in August reported to the Department of Health and Human Services’ Office for Civil Rights that the hacking incident affected 260,000 patients (see: Hacks on Specialty Health Entities Affected Nearly 900,000).

The largest hack on a medical imaging provider to date was reported to HHS’ Office for Civil Rights in 2022 by Massachusetts-based Shields Health Care Group as affecting more than 2 million patients (see: Hack of Medical Imaging Provider Affects Data of 2 Million).