SimonMed Imaging simonmed.com SimonMed Imaging data breach: what happened and what to do
SimonMed Imaging reported that a cybersecurity incident at a business associate exposed the health information of 1,275,669 people. Access began on January 21, 2025. HHS describes the data only as clinical and demographic information, so treat medical and identity details as at risk.
View all 13,115 breaches- Breach date
- 21 Jan 2025
- Affected
- 1,275,669
- Last updated
What happened
SimonMed Imaging, a US radiology and imaging provider, told the US Department of Health and Human Services (HHS) that one of its business associates (a vendor that handles patient data for it) suffered a cybersecurity incident. The incident affected the protected health information of 1,275,669 people. The breach is dated January 21, 2025, and the filing appears on the HHS breach portal and the California Attorney General's list.
SimonMed said it notified HHS, the people affected and the media, and posted a substitute notice for anyone who can't be reached by mail.
What was exposed
HHS's case summary says the information involved was "clinical and demographic information." The summary names no individual fields. If your letter lists more, such as a Social Security number or insurance details, go by the letter.
Health records are hard to replace. Unlike a password, a diagnosis can't be reset, and criminals use the details to make phishing and phone scams sound real, for example a call that mentions your recent scan and asks you to "verify" billing information.
The company's response
Per HHS, SimonMed and the business associate added administrative and technical safeguards and retrained staff on protecting patient data.
What this means for you
If you were a SimonMed patient, watch for a notice by mail, and read it for the exact list of what was taken. Treat any call, text or email about your scan, bill or insurance with suspicion until you've checked it by calling the number on your insurance card.
What to do if you were in it
- 1
Read your notice letter
It lists exactly which of your details were involved and whether SimonMed offers free credit monitoring. Take the offer if there is one.
- 2
Expect scams that mention your care
Don't act on a call, text or email about a scan, a bill or your insurance. Hang up and call the number on your insurance card or your bill.
- 3
Read your insurance statements
Check explanation of benefits (EOB) letters for services you didn't receive. If something is off, call your insurer's fraud line.
- 4
Freeze your credit at all three bureaus
A freeze stops lenders from opening new accounts in your name. It's free and takes a few minutes each at Equifax, Experian and TransUnion. Lift it temporarily when you apply for credit yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appear in. Serus monitors breach databases and the dark web and alerts you if your details show up again. It can't remove data that has already leaked.
Frequently asked
Was I affected by the SimonMed Imaging data breach?
SimonMed says it notified every person affected, by mail or substitute notice. If you were a patient and got no letter, contact SimonMed to ask.
What data was exposed in the SimonMed breach?
HHS describes it as clinical and demographic information. The summary names no individual fields, so your own letter is the best guide.
How many people were affected?
1,275,669 people, according to SimonMed's report to HHS.
Should I freeze my credit?
If your letter mentions a Social Security number or other ID details, yes. A freeze is free and easy to lift.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
