Lumexa Imaging

Disclosed May 15, 20265,830,949 affectedConfirmed

The covered entity (CE), Lumexa Imaging, reported that it was notified by its business associate (BA) that it experienced a breach involving access to its network by an unauthorized threat actor. According to the breach report, the breach affected approximately 5,830,949 individuals. The protected health information involved demographic, financial, and treatment information. The CE notified HHS, the media, and the affected individuals. OCR provided technical assistance to the CE regarding the HIPAA Rules.

What is known

People affected	5,830,949 (as reported to HHS)
Disclosed	May 15, 2026
Discovered	Apr 15, 2026
Happened	Mar 31, 2026
Attack	Hacking
Data exposed	Social Security numbersHealthInsuranceNames
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Lumexa Imaging

Official noticeatg.wa.gov

Washington Attorney General breach notice: Lumexa Imaging

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Lumexa Imaging

Official noticeoag.my.site.com

Texas Attorney General data security breach report BR-0005042: Lumexa Imaging

Official noticeago.vermont.gov

Vermont Attorney General breach report: Lumexa Imaging

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Lumexa Imaging (Healthcare Provider, NC)

Notices filed

Residents of CAMay 15

California AGCount not stated

Residents of ORMay 15

Oregon DOJ2,994 people

TotalMay 15

HHS archive5,830,949 people

Residents of TXMay 18

Texas AG251 people

Residents of WAJun 12

Washington AG3,632 people

Residents of VTJun 12

Vermont AG98 people

History of this record

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

2994 to 5830949by backfillSource

summary2026-09-25

empty to The covered entity (CE), Lumexa Imaging, reported that it was notified by its business associate (BA) that it experienced a breach involving access to its network by an unauthorized threat actor. According to the breach report, the breach aby backfillSource

source2026-09-25

empty to https://ago.vermont.gov/categories/security-breach-noticesby backfillSource

data_types2026-09-25

[] to ["ssn","health","insurance","names"]by backfillSource

records_basis2026-09-25

empty to organizationby backfillSource

records2026-09-25

empty to 2994by backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2026-04-15by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Lumexa Imaging