Associated Radiologists of the Finger Lakes, P.C. Data Breach 2025: 501 Affected · Hacking/IT Incident · NY. Filed With HHS OCR. What To Do.

Associated Radiologists of the Finger Lakes, P.C., an Elmira, New York radiology group, reported a hacking incident to the U.S. Department of Health and Human Services Office for Civil Rights on December 29, 2025, listing 501 individuals as an interim placeholder count while a file-level review continued. According to the practice’s own Notice of Data Privacy, an unauthorized party accessed a subset of its network between October 28 and October 30, 2025, when anomalous activity was detected and access was contained. The final affected count is expected to grow once mailed notification letters go out.

Timeline

• October 28, 2025. Unauthorized access to the network begins, per the entity’s substitute notice.
• October 30, 2025. Anomalous activity is detected; the practice brings portions of the network offline and engages third-party cybersecurity specialists. The incident is reported to the FBI.
• December 29, 2025. The breach is filed with HHS OCR as a Hacking/IT Incident at a Network Server, with an interim count of 501 affected individuals.
• April 23, 2026. The practice publishes its Notice of Data Privacy as substitute notice and begins individual mailings.

Data potentially exposed

The entity’s notice states the information involved varies per individual but may include:

• Name and address
• Date of birth
• Medical record number
• Full or partial Social Security number
• Driver’s license or other state ID number
• Financial account information
• Clinical or treatment information
• Medical procedure information
• Medical provider name
• Prescription information
• Health insurance information

No attacker has been publicly attributed, and the practice states it is unaware of any actual or attempted misuse of the data.

What the practice is offering

Associated Radiologists of the Finger Lakes is offering complimentary identity monitoring through CyberScout (a TransUnion subsidiary). The duration and enrollment deadline are not stated in the public substitute notice; affected individuals will receive enrollment instructions in their mailed notification letter.

Class-action posture

As of this writing, no class action has been filed. Multiple plaintiff firms — including Federman & Sherwood and Barnow and Associates — have opened investigations and are soliciting potential class representatives. ClassAction.org notes its own affiliated attorneys completed an investigation with no suit filed.

What to do if you may be affected

• Watch the mail. The notification letter from Associated Radiologists of the Finger Lakes will list the specific data elements exposed for you and explain how to enroll in the CyberScout identity monitoring offering.
• Freeze your credit with all three nationwide credit bureaus. It is free, takes about ten minutes per bureau, and blocks new accounts from being opened in your name even if a Social Security number was exposed.
• If your Social Security number was involved, request an IRS Identity Protection PIN for tax filings and review your Social Security earnings record at ssa.gov for unfamiliar employer entries.
• For health insurance information, review your explanation-of-benefits statements for services you did not receive. Medical identity theft is a separate harm from financial identity theft and is harder to detect.
• Bookmark this page. We update it as the final affected count, any class-action filing, and any OCR resolution become public.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record (Hacking/IT Incident, Network Server, 501 affected, filed December 29, 2025).
• Associated Radiologists of the Finger Lakes — Notice of Data Privacy — entity’s own substitute notice with access dates, data elements, and the CyberScout offering.
• Paubox — network breach report — industry summary of the incident timeline and response.
• ClassAction.org — December 2025 case page — investigation status and case background.
• calHIPAA — December 2025 Healthcare Data Breach Report — monthly OCR roll-up confirming the 501 interim count.
• Federman & Sherwood and Barnow and Associates — class-action investigation notices.