VULNpocalypse
Breaches and incidentsBriefReported by a reputable outlet, citing the company

Lumexa Imaging: vendor breach exposes 5.83 million radiology patients

Lumexa first reported 2,994 affected to HHS OCR and later updated the count to 5,830,949, making it the largest healthcare breach of H1 2026 per HIPAA Journal.

Disclosed

What happened

  • Lumexa first reported 2,994 affected to HHS OCR and later updated the count to 5,830,949, making it the largest healthcare breach of H1 2026 per HIPAA Journal. A vendor providing non-clinical administrative support was breached between 31 Mar and 9 Apr 2026; on 15 Apr Lumexa learned the actor may have used the vendor’s connection to view or obtain documents of its affiliated practices. Data: names, birth dates, addresses, phone numbers, account and insurance numbers, diagnoses, visit dates and radiology service details; SSNs for a small subset.
  • Root cause: compromise of an unnamed third-party vendor with a trusted connection into Lumexa systems.
  • Attacker: not named.
  • Response: vendor access cut on 9 Apr; letters from 15 May and 12 Jun; credit monitoring for SSN-exposed patients; consolidated class action in North Carolina federal court.

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.