Saint Pete MRI data breach: scanned patient files, notified 17 months after the activity

What happened at Saint Pete MRI?

SPMRI says that on or around February 23, 2025 it became aware of suspicious activity in its network, secured its systems and hired independent forensic experts. The experts confirmed that the electronic patient care and imaging systems were not accessed. What may have been taken was certain scanned data. The notice does not say how the intruder got in, what the scanned data was (paper records, forms or images), or who was behind it.

An independent team then reviewed the files. On April 7, 2026 that review found personal information in the affected data, and the work of identifying people and finding their addresses was completed on July 15, 2026. SPMRI mailed letters on July 22, 2026, and it also notified the federal health department's Office for Civil Rights.

Date	What happened	Source
February 4, 2025	Breach date in Indiana's record	Indiana record
On or around February 23, 2025	SPMRI becomes aware of suspicious network activity	Substitute notice
April 7, 2026	File review finds personal information in the data	Substitute notice
July 15, 2026	Identification of people and addresses completed	Substitute notice
July 22, 2026	Letters mailed; substitute notice posted; reported to Massachusetts	Substitute notice; Massachusetts and Indiana records

The letters went out 514 days after SPMRI became aware of the activity. About 13 and a half months passed before the file review found personal information on April 7, 2026, and another 106 days went on finding people and addresses and mailing the letters. Indiana's row gives February 4, 2025 as the breach date, 19 days before the date SPMRI gives for noticing it. The guide to how long companies take to notify compares this with other notices in this log.

What information was in the Saint Pete MRI breach?

The notice lists name, Social Security number, date of birth, driver's licence or state ID number, medical information and health insurance information, varying by person. SPMRI says it has no evidence of misuse or attempted misuse. Massachusetts's record marks Social Security numbers, medical records and driver's licences as breached, and financial accounts and card numbers as not.

Data type	Substitute notice	Massachusetts record
Name	Yes	Not tracked
Social Security number	Yes	Yes
Date of birth	Yes	Not tracked
Driver's licence or state ID	Yes	Yes
Medical information	Yes	Yes
Health insurance information	Yes	Not tracked
Financial account or card number	Not listed	No

The guide to health care provider breach notices compares how other clinics and medical groups describe what they lost.

How many people were affected by the Saint Pete MRI breach?

138,209 people. Indiana's attorney general and the federal health breach portal give the same total. The portal lists MRI Associates of St. Pete, doing business as Saint Pete MRI, as a health care provider, with a hacking incident on a network server submitted on August 19, 2025.

Record	People counted
HHS breach portal, total	138,209
Indiana attorney general, total	138,209
Massachusetts residents	107
Indiana residents	86

Some of the people could not be reached by mail. SPMRI says it could not find contact information for some of them, and posted the notice on its website as a substitute. The ranking of 2026 breaches by people affected shows where the Indiana total falls.

What is Saint Pete MRI offering?

Twenty-four months of credit monitoring and identity protection through Epiq Privacy Solutions ID, at no cost. The Massachusetts letter lists single-bureau credit monitoring with alerts, Social Security number and dark web monitoring, identity restoration and lost wallet help, and a $1M identity theft insurance policy. Enrolment uses the activation code printed on each letter.

Item	Detail from the letter
Provider	Epiq Privacy Solutions ID
Length	24 months
Includes	One-bureau monitoring, SSN and dark web monitoring, restoration, $1M insurance
Enrolment	Activation code in each letter
Call center	1-877-396-3217, Monday to Friday, 9 a.m. to 9 p.m. Eastern Time

The guide to credit-monitoring offers compares this offer with others in this log.

Was my information in the Saint Pete MRI data breach?

If you received a letter from Saint Pete MRI about a data security incident, sent from a secure processing center in Central Islip, New York, your information may have been in the scanned data. If you were a patient and got no letter, SPMRI set up a toll-free call center for questions about the incident, open Monday to Friday from 9 a.m. to 9 p.m. Eastern Time, excluding major U.S. holidays. The notice tells people to keep watching account statements and credit reports.

The Massachusetts letter adds that a security freeze is placed by written request to each of Equifax, Experian and TransUnion.

What the notice leaves open

• How the intruder got into the network, and what the scanned data was.
• Why Indiana's record gives February 4, 2025 and the notice February 23.
• Why the file review took until April 2026.
• The total SPMRI reported to the federal health department.