Lumexa Imaging
Disclosed May 15, 20264 months ago5,830,949 affectedConfirmed
The covered entity (CE), Lumexa Imaging, reported that it was notified by its business associate (BA) that it experienced a breach involving access to its network by an unauthorized threat actor. According to the breach report, the breach affected approximately 5,830,949 individuals. The protected health information involved demographic, financial, and treatment information. The CE notified HHS, the media, and the affected individuals. OCR provided technical assistance to the CE regarding the HIPAA Rules.
What is known
| People affected | 5,830,949 (as reported to HHS) |
|---|---|
| Disclosed | May 15, 2026 |
| Discovered | Apr 15, 2026 |
| Happened | Mar 31, 2026 |
| Attack | Hacking |
| Data exposed | Social Security numbers, Health, Insurance, Names |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Lumexa Imagingoag.ca.gov · Official notice | Official notice |
| Washington Attorney General breach notice: Lumexa Imagingatg.wa.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Lumexa Imagingjustice.oregon.gov · Official notice | Official notice |
| Texas Attorney General data security breach report BR-0005042: Lumexa Imagingoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General breach report: Lumexa Imagingago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Lumexa Imaging (Healthcare Provider, NC)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 15 | |
| Oregon DOJresidents of OR | May 15 | 2,994 |
| HHS archivetotal | May 15 | 5,830,949 |
| Texas AGresidents of TX | May 18 | 251 |
| Washington AGresidents of WA | Jun 12 | 3,632 |
| Vermont AGresidents of VT | Jun 12 | 98 |
History of this record
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 2994 to 5830949 · backfill source
- 2026-09-25 · summary: empty to The covered entity (CE), Lumexa Imaging, reported that it was notified by its business associate (BA) that it experienced a breach involving access to its network by an unauthorized threat actor. According to the breach report, the breach a · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/categories/security-breach-notices · backfill source
- 2026-09-25 · data_types: [] to ["ssn","health","insurance","names"] · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 2994 · backfill source
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · discovered: empty to 2026-04-15 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.