Medical Imaging Practice Notifying Patients of Recent Hack

An Arizona-based medical imaging practice with 160 locations in 11 states is notifying patients that their information was compromised in a cyberattack discovered in late January. Proposed class action lawsuits filed against the company in recent weeks allege ransomware gang Medusa stole sensitive data pertaining to at least 132,000 people in the incident.

See Also: Top 10 Technical Predictions for 2025

SimonMed Imaging in a breach statement said that on Jan. 27 it was alerted by one of its vendors that the entity was experiencing a security incident.

SimonMed Imaging said it quickly began a review of its systems and on the following day found suspicious activity on its network.

“Upon discovering we were the victim of a criminal attack, we immediately began an investigation and took steps to contain the situation,” SimonMed said.

That included resetting passwords, enhancing multifactor authentication, implementing endpoint detection and response monitoring, removing all third-party vendor direct access to systems within SimonMed’s environment and all associated tools, limiting only whitelisted traffic into and from its network, the practice said.

In addition, SimonMed said it notified law enforcement and engaged data security and privacy professionals to assist in the situation.

SimonMed’s investigation into the incident has so far found no unauthorized access to it systems between Jan. 21 and Feb. 5.

Potentially affected information includes name, address, birth date, date of service, provider name, medical record number, patient number, medical condition, diagnosis and treatment information, medications, health insurance information and driver’s license numbers, SimonMed said.

But at least one of three proposed federal class action lawsuits filed in recent weeks against SimonMed alleges that data stolen in the incident includes a much broader scope of information, including payroll data, Social Security numbers and images of driver’s licenses and passports.

A complaint filed on Feb. 21 by SimonMed patient Rosemary Hamermaster, on behalf of herself and others similarly situated, alleges that cybercriminal gang Medusa on its dark website in early February claimed to have exfiltrated from SimonMed’s IT systems 212 gigabytes of files containing at least 132,000 individuals’ personal information.

“The data leaked thus far includes, for example, photocopied driver’s licenses and passports, and a spreadsheet with records of over 1 million mammograms defendant performed on patients, including corresponding patient names and dates and locations of service,” the lawsuit alleges.

Medusa also threatened to publish the entire trove of information compromised in the data breach to its dark web leak site if SimonMed did not comply with its ransom demands by Feb. 21, the lawsuit alleged.

As of Wednesday, Medusa’s dark web leak site did not appear to contain a listing for SimonMed’s data. Also, as of Wednesday, the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals did not yet appear to have posted a breach report filed by SimonMed.

Similar to the other proposed class action lawsuits filed so far against SimonMed, Hamermaster’s complaint alleges, among other claims, that the medical imaging practice was negligent in failing to safeguard the plaintiff and class members’ sensitive information, putting the individuals at risk for identity theft and fraud.

The lawsuits seek relief including financial damages and an injunctive order for SimonMed to strengthen its data security practices.

SimonMed in its breach notice said its team has been adding “further technical safeguards to our existing protections.”

SimonMed did not immediately respond to Information Security Media Group’s request for comment and additional details about its incident, including whether the entity had paid a ransom to Medusa in exchange for a promise to delete the radiology practice’s allegedly stolen data from the cybercriminal group’s dark website.

Radiology Attacks

SimonMed is among many radiology practices hit by cyberattacks in recent years. Those incidents have resulted in major health data compromises and often in serious disruptions to patient care.

Pinehurst Radiology, a small practice in rural North Carolina, closed down for several weeks while it recovered from a cyber incident in January. As of Wednesday, the practice appeared to be reopened. So far, the HHS OCR breach reporting website does not show a report filed by Pinehurst Radiology.

Last June, Eden Prairie, Minnesota-based Consulting Radiologists Ltd. in a report to regulators said nearly 512,000 individuals were affected by a hacking breach.

To date, the largest hack on a medical imaging provider was reported to HHS’ Office for Civil Rights in 2022 by Massachusetts-based Shields Health Care Group as affecting more than 2 million patients (see: Hack of Medical Imaging Provider Affects Data of 2 Million).