Lumexa Imaging data breach: radiology patients' documents taken from a vendor's system

What happened in the Lumexa Imaging breach?

Lumexa says the vendor, which handled non-clinical operational support, told it on April 9, 2026 that it was investigating suspicious activity in the part of its network set aside for Lumexa's practices. Lumexa disconnected its systems from the vendor's network. On April 15 it learned that documents may have been viewed or copied.

Before reconnecting, Lumexa says, the vendor assured it that it had reset passwords, scrubbed and validated the affected systems and added monitoring and detection tools. The letter does not name the vendor.

Date	What the letter and the regulators' records say
March 31, 2026	Documents begin to be taken; breach date on California's record and Washington's list
April 9, 2026	The vendor tells Lumexa; Lumexa disconnects; the taking ends
April 15, 2026	Lumexa learns patient documents may have been viewed or copied
May 15, 2026	Notice recorded by California
May 18, 2026	Posted on the Texas attorney general's list
June 12, 2026	Notice recorded by Washington; report logged in Massachusetts

What information was involved?

The letter says the information varied by document and by person, and may have included names; identifiers such as date of birth, address, phone number, Social Security number or patient account number; insurance information; and clinical information such as visit dates, diagnoses or other health information related to radiology services. Washington and Texas list Social Security numbers, medical and insurance information; Massachusetts marks Social Security numbers as breached.

How many people were affected?

Regulator	What it counts	Number
Washington attorney general	Washingtonians	3,632
Massachusetts consumer affairs office	Massachusetts residents	825
Texas attorney general	Texans	251
HHS Office for Civil Rights	Individuals affected	5,830,949

HHS's breach portal lists a report from Lumexa Imaging, a healthcare provider in North Carolina, submitted on May 15, 2026, with 5,830,949 individuals affected. It is filed as a hacking or IT incident on a network server. The report sits in the portal's archive, not among the open cases. That is why earlier downloads of the open list missed it. It is the largest 2026 report in the archive and the fourth largest of 2026 on the portal overall (2026 ranking). The state lists count only their own residents.

What is Lumexa offering people who got a letter?

Kroll identity monitoring at no cost, with credit monitoring, fraud consultation and identity theft restoration; the number of months and the activation deadline are blank fields in the filed copy.

Item	Detail from the letter
Provider	Kroll
Enrollment	enroll.krollmonitoring.com, with the membership number on the letter
Phone	(844) 959-7072, Monday to Friday, 8:00 a.m. to 5:30 p.m. Central Time, excluding holidays

Why did I get a letter from Lumexa Imaging?

You had imaging at one of Lumexa's affiliated radiology practices or imaging centers, and a vendor working for Lumexa held documents with your information. The guide to letters from companies you never dealt with explains the chain.

What Lumexa told investors about the vendor breach

Lumexa Imaging is listed (ticker LMRI), and both of its quarterly reports since the breach carry a short "Vendor Data Disclosure" section. The first, filed May 12, 2026, says patient data including protected health information was extracted from the systems of a vendor providing non-clinical administrative services. Lumexa learned of it on April 15, 2026. The filings add two facts the letter does not state. Law enforcement was notified, and the investigation found no malicious code on Lumexa's own systems and no material interruption to its business.

Lumexa did not expect the incident to be material, while it was still weighing remediation costs and other possible liabilities. The second report, filed August 13, 2026, repeats that view in the same words. It still describes the company as identifying and notifying the people involved, although California had recorded its notice in May and Washington in June. The filings name neither the vendor nor the number of patients.

Filed	Filing	What it says
May 12, 2026	Form 10-Q, quarter ended March 31, 2026	Data extracted from a vendor's systems; learned April 15, 2026; law enforcement told; no malicious code on Lumexa's systems; not expected to be material
August 13, 2026	Form 10-Q, quarter ended June 30, 2026	Same account, "as previously disclosed"; still not expected to be material

Lumexa did not file an 8-K about the breach. The guide to Item 8.01 versus Item 1.05 explains when a listed company uses each form.

Did the Lumexa breach reach Lumexa's own systems?

According to its SEC reports, no. The investigation found no malicious code placed on any Lumexa system, and the data was taken from the vendor's systems.

What the documents leave open

• Which vendor was breached, and how.
• Whether HHS's 5,830,949 is final. The state lists give only their own residents.
• Which practices and imaging centers are affected.