Dermatology, Imaging Hacks Expose 3.3 Million Patients’ PHI

A Maryland-based dermatology practice and a Virginia-based medical imaging and radiology entity have each reported to federal regulators separate hacking incidents that affected the protected health information of more than 3.3 million patients.

See Also: 2025 Cyber Resilience Checklist

As of Thursday, each of the hacks – reported by Anne Arundel Dermatology and Radiology Associates of Richmond – ranked among the five largest health data breaches posted so far in 2025 on the U.S. of Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.

Annapolis, Md.-based Anne Arundel Dermatology, which on its website lists more than 100 patient care locations in seven states, reported to HHS’ Office for Civil Rights on July 11 that its hacking incident involved a network server and potentially compromised the PHI of 1.9 million people, the fourth-largest health data breach in 2025.

Anne Arundel Dermatology offers an array of skin services ranging from medical, surgical and cosmetic procedures, in Maryland, Florida, Georgia, North Carolina, Virginia, Pennsylvania and Tennessee.

Meanwhile, Richmond, Va.-based Radiology Associates of Richmond reported to HHS OCR on July 1 that its hacking incident also involved a network server and affected nearly 1.42 million people, the fifth largest HIPAA breach so far in 2025, as of Thursday.

Anne Arundel Dermatology Hack

In a sample breach notification letter provided to Vermont state regulators, the dermatology practice said that it had “recently” identified an intrusion in some IT systems by an unauthorized third party.

The practice’s assessment of the incident determined that the unauthorized access to its systems lasted about three months – from Feb. 14 to May 13.

AAD determined that affected files contained personal and health information that potentially included patient names, addresses, dates of birth, medical information, health insurance information and other details.

The practice said it does “not know” whether threat actors actually viewed or exfiltrated patient data, and that it is unaware of any misuse of or fraudulent activity relating to anyone’s information.

AAD did not immediately respond to Information Security Media Group’s request for additional details about the incident, including whether attackers deploy ransomware encryption or demanded an extortion payment.

As of Thursday, Anne Arundel Dermatology was already facing at least nine proposed federal class action lawsuits – all filed this week – related to the data breach.

The lawsuits seek financial damages and make similar claims, including allegations that the practice was negligent in failing to safeguard patients’ sensitive personal and health information.

Radiology Associates of Richmond Breach

Radiology Associates of Richmond Breach on its website said it has 63 radiologists that provide a variety of medical imaging and diagnostic services at seven hospitals in central Virginia, as well as three outpatient imaging centers.

Those hospitals include Chippenham Medical Center, Johnston-Willis Hospital, Henrico Doctors’ Hospital – Forest Campus, Henrico Doctors’ Hospital – Parham Campus, John Randolph Medical Center, Retreat Hospital and Spotsylvania Regional Medical Center.

Outpatient medical imaging facilities include Chesterfield Imaging Center, Independence Park Imaging Center and Appomattox Imaging Center.

The radiology group in a breach notice posted on its website said its incident involved unauthorized access to its systems for several days last year – from April 2 through April 6, 2024.

RAR did not indicate when it had first discovered its cybersecurity incident.

“Upon learning of this issue, we immediately worked to contain the threat and secure our internal environment,” the notice said. The practice worked with external cybersecurity experts to determine what type of personal or sensitive data may have been compromised as a result of this incident.

Among the potentially affected information is patients’ name, date of birth, email address, Social Security number, account number, routing number, medical information and health insurance information.

“RAR has no evidence that any personal information has been or will be misused as a direct result of this incident,” the notice said.

As of Thursday, Radiology Associates of Richmond Breach also faced several proposed federal class action lawsuits related to the hack.

The company did not immediately respond to ISMG’s request for comment and additional details about the hack.