Lumexa Imaging lumexaimaging.com Lumexa Imaging data breach: what happened and what to do
Lumexa Imaging, a radiology provider, reported a breach affecting 5,830,949 people to HHS. A vendor's systems were accessed between March 31 and April 9, 2026. Patient names, birth dates, insurance details and diagnoses were exposed. Some Social Security numbers were too.
View all 13,115 breaches- Breach date
- 31 Mar 2026
- Affected
- 5,830,949
- Data exposed
- Names, Dates of birth, Physical addresses, Phone numbers, Health insurance information, Medical information, Social security numbers
- Last updated
Lumexa Imaging is a network of radiology and imaging centers. In 2026 it told the U.S. Department of Health and Human Services (HHS) that a breach had hit patient records, and the number it reported grew a lot over time. The first filing listed 2,994 people. The updated filing lists 5,830,949, which made it the largest healthcare data breach reported in the first half of 2026.
What happened
The breach did not start inside Lumexa's own network. It happened at a vendor that provided non-clinical support for the administrative work of Lumexa's affiliated radiology practices. An unauthorized person used the connection between Lumexa and that vendor to view or copy documents. The investigation placed the vendor breach between March 31 and April 9, 2026.
The vendor flagged suspicious activity on April 9, 2026. Lumexa learned on April 15 that documents containing patient information may have been viewed or taken. Lumexa reported it to HHS and notified the people affected, as the HIPAA rules require.
What was exposed
What leaked depends on the document and the person. The records included names, dates of birth and addresses. Phone numbers too. They also included patient account numbers and health insurance details. Visit dates and diagnoses were in there too. A small group of patients had their Social Security numbers exposed too.
If you had a scan at a Lumexa center, the visit date and type of scan can be as sensitive as an ID number. Together with your name and address, they tell a scammer enough to sound like your provider.
What criminals can do with it
A name and an insurance plan make a convincing call. Expect messages that claim to be from a radiology office or your insurer and ask you to confirm details or pay a balance. People answer when a message sounds like it's about their health.
Where a Social Security number and date of birth are exposed together, the risk is identity theft: loans or tax returns filed in your name. Insurance details can feed medical identity theft. That is when someone else gets care on your coverage.
Lumexa's response
Lumexa says it is unaware of any misuse of the exposed data. It is offering free credit monitoring to people whose Social Security numbers were affected. People with questions can call the number on their notice letter.
What the number means
The 5,830,949 figure is the total reported to HHS. It counts people across the practices connected to Lumexa, not only one clinic. If you have been a patient of an imaging center that partners with Lumexa, check whether a letter arrived, including in the mail you set aside.
What to do if you were in it
- 1
Read the notice letter and use the credit monitoring
If a letter says your Social Security number was involved, sign up for the free monitoring it offers before the enrollment deadline.
- 2
Freeze your credit at all three bureaus
If your Social Security number is on the notice, freeze your credit at Equifax, Experian and TransUnion. A freeze is free and takes a few minutes online. It stops new credit being opened in your name. Lift it whenever you apply for something yourself.
- 3
Expect calls and texts that mention your care
Treat any message about a scan or a bill as suspect. Hang up and call the number on your insurance card or on the practice's own website.
- 4
Read your insurance statements
Check each explanation of benefits for visits or prescriptions you don't recognize. If you find one, tell your insurer's fraud team.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan checks breach databases for your email and phone, then tells you what to do about each hit.
Frequently asked
Was I affected by the Lumexa Imaging breach?
Lumexa and its affiliated practices sent letters to the people affected. If you had imaging at a Lumexa center and got a letter, you were included. HHS lists 5,830,949 people in total.
What was exposed in the Lumexa Imaging breach?
Names, birth dates, contact details, account numbers and insurance details, plus visit dates and diagnoses. A small group of patients also had their Social Security numbers exposed.
Do I need to change my password?
Passwords were not reported as part of this breach. If you use a patient portal, a fresh password and two-factor login are still cheap protection, because scammers may contact you pretending to be the portal.
Is there a settlement?
No source reports a settlement.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
