On or about April 9, 2026, Lumexa Imaging (“Lumexa”) became aware of suspicious activity involving a third-party vendor’s network used to support its services. According to the Notice of Data Event, Lumexa promptly disconnected from the vendor’s systems, initiated an investigation, and worked with forensic specialists to determine what occurred.
Following the initial investigation, Lumexa confirmed on April 15, 2026, that certain patient information may have been impacted. The forensic review later determined that documents were accessed or taken without authorization between March 31, 2026 and April 9, 2026. Because of the volume of data involved, it was not until May and June 2026 that Lumexa identified affected individuals and issued notification letters.
After identifying the affected files, Lumexa worked with the vendor to resecure the environment and strengthen cybersecurity safeguards, including system remediation and enhanced monitoring tools.
Lumexa Imaging provides administrative services to affiliated radiology practices and imaging centers, including operational support and coordination of non-clinical services.
Lumexa stated that, at the time of notification, it had not identified reports of identity theft or fraud associated with the incident. However, unauthorized access to sensitive patient data may have occurred.
Individuals began receiving written notification letters starting in May 15, 2026, with additional notices sent on June 12, 2026. If you received a Notice of Data Event from Lumexa Imaging, it confirms that your information may have been involved.
As part of its response, Lumexa is offering affected individuals complimentary identity monitoring and protection services through Kroll.
What information is involved in the Lumexa Imaging Data Breach?
Compromised information may include:
First Name
Last Name
Date of Birth
Address and Phone Number
Social Security Number
Patient Account Number
Insurance Information
Clinical and medical information related to radiology services
The specific data elements vary by individual and are detailed in each notification letter.
Your Personally Identifiable Information (PII) includes identifying details such as your name and personal identifiers. Exposure of this information increases the risk of identity theft and financial fraud.
In addition, much of the information involved qualifies as Protected Health Information (PHI), which is legally protected and may be misused for medical identity theft or fraudulent healthcare billing.
If your information was involved, you should remain vigilant, monitor financial and medical records, and follow the steps provided in the notification letter.
Patients may have legal rights when healthcare-related data is not properly protected.
If you received a Notice of Data Event related to the Lumexa Imaging incident, your personal and health information may be at risk.
Contact the Data Breach Attorneys at Emery | Reddy today for a Free Case Review.