Radiology Associates of Richmond Data Breach 2025: 1,419,091 Virginia Radiology Patients Exposed in April 2024 Network Intrusion. What To Do

Radiology Associates of Richmond (RAR), founded in 1905 and one of the oldest continuously operating private radiology practices in the United States, disclosed in July 2025 that an unauthorized actor accessed its network environment for four days in early April 2024. The intrusion exposed names, dates of birth, Social Security numbers, medical information, and health-insurance details belonging to 1,419,091 individuals. RAR serves central Virginia, supporting nine hospitals, several emergency centers, and multiple outpatient imaging facilities with services including MRI, CT, X-ray, mammography, neuroradiology, pediatric radiology, and nuclear medicine.

RAR did not finish its forensic review until May 2, 2025, and did not begin notifying patients until July 1, 2025, more than 15 months after the access occurred. That notification delay became the central argument in multiple class-action lawsuits. RAR reported the April 2024 breach to the attorneys general of California, Massachusetts, Washington, Montana, and Vermont concurrently with its HHS OCR filing.

What happened

An unauthorized actor gained access to RAR’s network environment beginning April 2, 2024. The intrusion ended April 6, 2024, a four-day window. RAR engaged external cybersecurity professionals to investigate, and those professionals completed the forensic and manual document review on May 2, 2025, when it became clear that the accessed files contained identifiable protected health information and personal data.

RAR posted a substitute notice, began mailing individual letters, and filed with HHS OCR on July 1, 2025. The federal portal records 1,419,091 affected individuals, classifying the event as a Hacking/IT Incident at a Network Server. No ransomware group has publicly claimed responsibility, and no leak-site posting has been observed.

A second, separate unauthorized access event occurred on or around July 25, 2025, after notification for this breach was already underway. That subsequent incident affected 266,183 individuals and was disclosed separately in May 2026. See the note at the bottom of this page for more detail.

What was stolen

RAR’s substitute notice describes the impacted files as containing “identifiable protected health and personal information.” State AG filings and the entity’s own notice letter identify the following categories:

• Patient names
• Dates of birth
• Social Security numbers (a subset of affected individuals)
• Medical information
• Health-insurance information

The Arnold Law Firm’s investigation page and state AG sample letters list additional possible elements: email addresses, addresses, driver’s license or government ID numbers, financial account and routing numbers. RAR’s own notice does not confirm all of those categories. Per the sourcing rule, the above list reflects what the entity’s notice and state AG filings confirm. Affected individuals should read their specific notification letter for the elements confirmed for their record.

RAR states it has “no evidence that any personal information has been or will be misused as a direct result of this incident.”

What Radiology Associates of Richmond is offering

RAR is providing complimentary credit-monitoring services through Cyberscout to individuals whose Social Security numbers were contained in the impacted files. The activation code and enrollment instructions appear in each notification letter. Individuals whose Social Security numbers were not in the accessed files received the notification but were not offered monitoring.

The entity set up a dedicated response line at 1-866-629-5541 (Monday through Friday, 8 a.m. to 8 p.m. Eastern). No identity-theft insurance amount, fraud-resolution services, or remediation steps for non-SSN data elements were publicly disclosed.

Class actions

At least 10 complaints were filed against RAR in the weeks following the July 2025 notification. Those cases were consolidated into a single proceeding in the U.S. District Court for the Eastern District of Virginia. A complaint filed August 18, 2025, names a minor (identified as “Jane Doe”) as plaintiff, with legal representatives arguing RAR failed to monitor its network adequately and allowed “almost a month of unimpeded access” before the intrusion ended. Plaintiffs are seeking at least $5 million.

Firms that have publicly announced investigations or filings for the April 2024 breach:

• Strauss Borrelli PLLC
• Lynch Carpenter LLP
• Edelson Lechtzin LLP
• Arnold Law Firm

The common theory across all filings is the 15-month gap between the April 2024 intrusion and the July 2025 notification, which plaintiffs argue violates HIPAA’s 60-day notification requirement and Virginia law.

Subsequent incident: July 2025 breach

RAR disclosed a second, unrelated network intrusion in May 2026. That incident, which began on or around July 25, 2025, affected 266,183 individuals. RAR’s forensic investigation concluded April 6, 2026, and notifications were mailed beginning May 21, 2026. RAR filed with the Maine AG (266,183 residents) and the Massachusetts AG (Report #2026-829). Schubert Jonckheer & Kolbe LLP announced an investigation on May 23, 2026. This is a separate HHS OCR filing from the 1.4 million-person breach documented on this page.

What to do

1. Freeze your credit at all three bureaus: Equifax (equifax.com), Experian (experian.com), and TransUnion (transunion.com). Freezes are free, reversible when you need to apply for credit, and the single most effective step against new-account fraud when Social Security numbers are involved.
2. Enroll in Cyberscout credit monitoring if your notification letter includes an activation code. Only individuals whose SSNs were in the accessed files received an offer; if you have a code, use it promptly.
3. File IRS Form 14039 (Identity Theft Affidavit) if you were notified that your Social Security number was exposed. This flags your tax record and reduces the risk of fraudulent return filing.
4. Watch your Explanation of Benefits statements. RAR is a radiology provider, meaning your medical and insurance records were in scope. Scan EOBs from your health insurer for unfamiliar providers, imaging studies, or procedure dates you don’t recognize.
5. Keep your notification letter. It is proof of your standing in any class-action recovery and specifies exactly which data elements were in your record.
6. Guard against follow-on phishing. Breach notifications trigger secondary scams. RAR will not ask for payment, passwords, or financial account details by phone or email in connection with this incident.
7. Stop the ongoing flow of your radiology and medical-imaging data. HealthConsent files HIPAA restriction requests so the diagnostic records, insurance details, and identifying information exposed in this breach are not continuously re-shared across health information exchanges and downstream business associates.

Continue reading

• Your HIPAA rights — how to limit what your provider shares and with whom
• All tracked breaches — full list of incidents on HealthConsent