Radiology Associates of Richmond data breach: a second notice in 2026, for a July 2025 intrusion

What does the 2026 letter say?

It opens the same way as the 2025 letter: as a result of a cybersecurity incident, the practice learned that an unauthorized actor had gained access to its network. It says the practice contained the threat, secured its internal environment and worked with outside cybersecurity professionals. The finding came after a forensic investigation and a manual review of documents. The access date it gives, on or about July 25, 2025, is more than a year after the April 2024 access described in 2025.

The 2026 letter does not say whether the two incidents are connected, how the actor got in, or why the review took until April 2026.

How the two notices compare

	2025 notice	2026 notice
Systems accessed	April 2 to April 6, 2024	On or about July 25, 2025
Found to hold personal information	May 2, 2025	On or about April 6, 2026
Reported to HHS	July 1, 2025: 1,419,091 people	May 21, 2026: 266,183 people
Credit monitoring	Single-bureau monitoring through Cyberscout	None offered in the letter

Together the two HHS reports count 1,685,274 people. Some may appear in both; neither notice says how many. The 2025 letter offered single-bureau credit monitoring through Cyberscout. The 2026 letter offers none. It points readers to fraud alerts, security freezes and free credit reports instead.

How many people were affected?

Regulator	What it counts	Number
HHS Office for Civil Rights	Individuals affected (May 21, 2026 report)	266,183
Indiana Attorney General	Total affected / Indiana residents	266,183 / 57
Massachusetts OCABR	Massachusetts residents	81
HHS Office for Civil Rights	Individuals affected (July 1, 2025 report, April 2024 breach)	1,419,091

Indiana's report gives the breach date as July 27, 2025, two days after the letter's "on or about" date. Massachusetts marks medical records and financial accounts as breached for its 81 residents, and not Social Security numbers.

What information was involved?

Each letter fills in the reader's own items. The Massachusetts sample shows only "your full name" before the list breaks off. The letter says the practice knows of no fraud or identity theft resulting directly from the incident.

The response line runs Monday to Friday, 8:00 a.m. to 8:00 p.m. ET, excluding holidays; the number is printed on each letter. The ranking of 2026 healthcare breaches reported to HHS puts the May 2026 report in context, and the guide to how long companies take to notify covers gaps like these.

What Texas's attorney general recorded

Texas's attorney general lists a report from Radiology Associates of Richmond, posted on May 22, 2026, with 299 Texans affected, a count of Texas residents only. The record lists government ID numbers, financial account or card information, medical information and health insurance information as involved.

What Washington's attorney general recorded

Washington's attorney general lists a report from Radiology Associates of Richmond Inc, received on July 1, 2025, with 570 Washington residents affected and a breach date of April 2, 2024. That is the first notice, for the April 2024 access. For those residents the record lists names, Social Security numbers, financial and banking information, dates of birth, health insurance numbers and medical information as compromised. The Washington list fetched for this entry has no report for the July 2025 access.

What the documents leave open

• Whether the July 2025 access is linked to the April 2024 one.
• How many people received both letters.
• Which data elements apply to which patients in the 2026 round.