SimonMed Imaging
Disclosed Mar 27, 20251 year ago1,275,669 affectedConfirmed
Medusa ransomware breach at SimonMed exposes 1.28 million patients
Radiology provider SimonMed said hackers had network access between January 21 and February 5, 2025, learned of it January 27 from a vendor, and the Medusa gang claimed 212 GB and demanded $1 million. It reported 1,275,669 affected people to HHS.
What is known
| People affected | 1,275,669 (as reported by the organization) |
|---|---|
| Disclosed | Mar 27, 2025 |
| Discovered | Jan 27, 2025 |
| Happened | Jan 21, 2025 |
| Attack | Ransomware |
| Data exposed | Names, Addresses, Dates of birth, Health, Insurance, Government IDs, Social Security numbers, Payment cards, Financial |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: SimonMed Imagingoag.ca.gov · Official notice | Official notice |
| SimonMed says 1.2 million patients impacted in January data breachbleepingcomputer.com · News | News |
| Largest Healthcare Data Breaches of 2025hipaajournal.com · News | News |
| Texas Attorney General data security breach report BR-0004609: SimonMed Imagingoag.my.site.com · Official notice | Official notice |
| Vermont Attorney General: 2025-10-10 SimonMed Imaging Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| Indiana Attorney General 2025 data breach report: SimonMed Imagingin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): SimonMed Imaging (Healthcare Provider, AZ)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 27, 2025 | 1,275,669 |
| California AGresidents of CA | Oct 10, 2025 | |
| Vermont AGresidents of VT | Oct 10, 2025 | |
| Indiana AGresidents of IN | Oct 10, 2025 | 211 |
| Researchtotal | Oct 13, 2025 | 1,275,669 |
| Texas AGresidents of TX | Oct 14, 2025 | 2,105 |
History of this record
- 2026-09-25 · disclosed: 2025-10-10 to 2025-03-27 · backfill source
- 2026-09-25 · source: empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2025.pdf · backfill source
- 2026-09-25 · source: empty to https://ago.vermont.gov/document/2025-10-10-simonmed-imaging-data-breach-notice-consumers · backfill source
- 2026-09-25 · data_types: ["names","addresses","dob","health","insurance","government-id"] to ["names","addresses","dob","health","insurance","government-id","ssn","payment-card","financial"] · backfill source
- 2026-09-25 · attack: unknown to ransomware · seed source
- 2026-09-25 · data_types: [] to ["names","addresses","dob","health","insurance","government-id"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 1275669 · seed source
- 2026-09-25 · discovered: empty to 2025-01-27 · seed source
- 2026-09-25 · summary: empty to Radiology provider SimonMed said hackers had network access between January 21 and February 5, 2025, learned of it January 27 from a vendor, and the Medusa gang claimed 212 GB and demanded $1 million. It reported 1,275,669 affected people t · seed source
- 2026-09-25 · title: empty to Medusa ransomware breach at SimonMed exposes 1.28 million patients · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.