Radiology Associates of Richmond data breach: what happened and what to do

What happened

Radiology Associates of Richmond, a private radiology practice in Virginia, reported a data breach that affected 266,183 people. The practice said an unauthorized party got into its network on or about 25 July 2025 and accessed internal files that held sensitive patient information. A forensic investigation and a manual review of the files finished on 6 April 2026.

The practice began sending notification letters on 21 May 2026, and its outside lawyers reported the incident to the Maine Attorney General the same day, according to coverage by SecurityWeek and UpGuard.

What was exposed

The type of information differs from person to person, and the practice's website notice does not list it. The individual letters say what was in each person's files. Reports on the notice describe patient information held by a radiology practice, which can include names, Social Security numbers, financial account details, medical records and health insurance details. Check your own letter to see what applies to you.

People whose Social Security numbers were in the files are being offered complimentary credit monitoring.

An earlier breach

This is the practice's second reported incident in a short time. In July 2025, it reported to the US Department of Health and Human Services a breach that occurred in April 2024 and affected more than 1.4 million patients, according to Paubox. If you were a patient, you may have received letters about both.

What to do

Read your notification letter first. It tells you which of your details were involved, and the right steps depend on that. If a Social Security number or financial account was listed, take up the credit monitoring offer, place a credit freeze at Equifax, Experian and TransUnion, and watch your statements. If medical or insurance details were listed, read your insurer's explanation of benefits for services you didn't receive. Steps are below.