Doctors Imaging Group Data Breach 2025: 171,862 Affected · Hacking/IT Incident · Florida Radiology Practice. What To Do.

What happened

Doctors Imaging Group (DIG) is a physician-owned radiology practice with imaging centers in Gainesville and Palatka, Florida. The practice serves patients across north-central Florida with diagnostic radiology services, making it a repository of imaging records, billing histories, and personal identification data for tens of thousands of patients.

DIG reported a Hacking/IT Incident at Network Server to the U.S. Department of Health and Human Services Office for Civil Rights on September 24, 2025, disclosing 171,862 affected individuals. Forensic investigators determined that unknown actors accessed the practice’s network between November 5 and November 11, 2024 — a six-day window — and copied files during that period. The practice notified federal law enforcement, secured its systems, and began a document-by-document review to determine which records were in the affected files. That review concluded on August 29, 2025, nearly ten months after detection. Individual notification letters were mailed beginning September 25, 2025.

No ransomware group has publicly claimed responsibility, and DIG has not characterized the attack as ransomware. As of the date of this page’s last update, no known threat actor has posted exfiltrated data on a public leak site. The nearly eleven-month gap between the breach and patient notification reflects the labor intensity of reviewing copied files record-by-record, a pattern that has drawn scrutiny in other large radiology-practice breaches.

On September 24, 2025, the same date as the HHS OCR filing, DIG notified the attorneys general of at least thirteen states: California, Iowa, Maine, Massachusetts, Montana, Nebraska, New Hampshire, Oregon, Rhode Island, South Carolina, Texas, Vermont, and Washington.

What was stolen

The file review, confirmed by DIG’s own notice posted at its website and corroborated by SecurityWeek and HIPAA Times, identified the following data elements as potentially exposed:

• Names
• Addresses
• Dates of birth
• Admission dates
• Medical treatment information
• Claims information
• Social Security numbers
• Patient account numbers
• Medical record numbers
• Financial account numbers
• Financial account types
• Health insurance information

This is a broad cross-section of both personal identity data and protected health information. The pairing of Social Security numbers, financial account numbers, and health insurance information with medical record content creates compounding fraud risk: new-account fraud, tax-refund fraud, and medical identity theft can be pursued simultaneously against the same individual.

What Doctors Imaging Group is offering

The notification letter sent to affected individuals confirmed that DIG is providing complimentary identity monitoring services through Kroll. The specific monitoring term length was not publicly confirmed in documents reviewed for this page; affected individuals should consult their specific notification letter for enrollment instructions and any deadline.

For questions, DIG established a toll-free dedicated assistance line: 866-291-1907, available Monday through Friday from 8:00 AM to 5:30 PM Central Time (excluding holidays). Written inquiries may be sent to Doctors Imaging Group at 6685 NW 9th Boulevard, Gainesville, Florida 32605, Attention: Rob Hardin. Email contact is available at [email protected].

If you received a letter and the Kroll enrollment window has passed, you can still enroll in monitoring directly with Kroll using the activation code in your letter.

Class actions

Strauss Borrelli PLLC publicly opened an investigation on September 25, 2025, the day notifications began. ClassAction.org opened and then closed an investigation without listing a filed complaint. As of the last update to this page, no consolidated class-action complaint has been publicly identified in the U.S. District Court for the Northern District of Florida (which covers Gainesville) or in Florida state court through the sources reviewed here. The matter remains OCR-open for federal regulatory purposes.

What to do

1. Enroll in Kroll monitoring using the code in your notification letter. If you cannot locate the letter, call the dedicated line at 866-291-1907 (Monday–Friday, 8 AM–5:30 PM CT).
2. Freeze your credit with Equifax (1-888-298-0045), Experian (1-888-397-3742), and TransUnion (1-833-799-5355). It is free, takes about ten minutes per bureau, and blocks new-account fraud even if an attacker holds your Social Security number and financial account details.
3. File an IRS Identity Protection PIN request at irs.gov/identity-theft-central if you have not already. A Social Security number exposed in a late-2024 incident is most often monetized through 2025–2026 tax-filing seasons.
4. Watch for medical identity theft. Review every explanation-of-benefits statement your health insurer sends for services you did not receive. Medical record numbers, claims information, and health insurance information were all exposed.
5. Preserve your notification letter. If a class action is filed and certified, the letter is evidence of class membership.
6. Stop the ongoing flow of your radiology and imaging data. HealthConsent files HIPAA restriction requests so the diagnostic and billing information exposed in this breach is not continuously re-shared across health information exchanges and downstream billing clearinghouses.

Continue reading

• Your HIPAA rights — how to request restrictions on the sharing of your records
• All tracked healthcare breaches