HealthConsent
Active breach tracker Winston-Salem, NC Disclosed February 6, 2026

Triad Radiology Associates Data Breach 2026: 11,011 Winston-Salem Patients Exposed in Email Compromise. 196-Day Notification Delay. What To Do

Triad Radiology Associates, a Winston-Salem NC private radiology practice affiliated with Novant Health, disclosed in February 2026 a July 2025 employee email compromise exposing names, Social Security numbers, driver's licenses, bank account information, dates of birth, medical information, and health insurance for 11,011 patients. 196 days from discovery to notification (well past HIPAA's 60-day rule). 12 months credit monitoring offered. Class actions filed in NC Business Court. Here is what to do.

You have options. Scroll for the exact action steps, what your provider’s response covers, and what your health data needs beyond credit monitoring.

By HealthConsent Editorial Last updated Sources & methodology

Timeline

Jul 11, 2025

Unauthorized access to employee email account begins

Jul 30, 2025

TRA detects suspicious activity; account secured; forensics engaged

Dec 10, 2025

File review concludes; PHI exposure confirmed

Feb 6, 2026

Filed with HHS OCR; website notice posted

Feb 11, 2026

Individual notification letters mailed (~196 days post-discovery)

Mar 25, 2026

Putative class actions filed in NC Business Court

Data exposed

01

High-risk identity

Enables financial + identity theft

Social Security number Driver's license number Date of birth

03

Contact & insurance

Phishing + targeted scams

Full name Home address Bank account information Medical information Health insurance information

Class actions filed by

These firms have publicly announced investigations. You may be eligible to join. We are not a law firm and cannot give legal advice.

Lynch Carpenter (publicly investigating) Cole & Van Note (publicly investigating) Migliaccio & Rathod (publicly investigating) McShane & Brady (publicly investigating) Bryson Harris Suciu & DeMay (publicly investigating) Gibbs Law Group (publicly investigating)
If you received a letter

Your action plan, in five steps.

You have more rights than the notification letter explains. Each step below is a concrete thing you can do today. Full detail and timing in the sections that follow.

01

Accept credit monitoring

It’s the floor of the response. Take it.

02

Freeze your credit

Free at Equifax, Experian, TransUnion.

03

File IRS Form 14039

Prevent fraudulent tax return under your SSN.

04

Review your EOBs

Insurance statements catch medical identity theft early.

05

Stop the ongoing flow

Credit monitoring doesn’t cover your health records. HealthConsent does.

Jump to step 5: protect my health data

What happened

Triad Radiology Associates is a private radiology practice in Winston-Salem, North Carolina serving the Piedmont Triad region. The practice is affiliated with Novant Health, Ashe Memorial Hospital, Life Bright Hospital, and Northern Regional Hospital.

On July 11, 2025, an unauthorized actor began accessing an employee email account. Triad Radiology detected the suspicious activity on July 30, 2025, secured the account, and engaged third-party forensics. The file review concluded on December 10, 2025, confirming PHI exposure. Triad Radiology filed with HHS OCR on February 6, 2026 and began mailing individual notification letters on February 11, 2026 — confirming 11,011 affected individuals.

The roughly 196-day gap between discovery and individual notification has been flagged by multiple outlets as well outside HIPAA’s 60-day notification rule.

The breach vector is business email compromise / credential phishing — a single employee mailbox compromise. No ransomware group has been named. No dark-web leak listing has been observed.

What was stolen

Per the entity’s notice (verbatim):

  • Full name
  • Home address
  • Social Security number
  • Driver’s license number
  • Bank account information
  • Date of birth
  • Medical information
  • Health insurance information

Radiology images (DICOM files) are not mentioned in the notice. Exposure is limited to the mailbox contents — referrals, reports, demographics, billing correspondence — rather than the imaging-archive itself.

What Triad Radiology is offering

  • 12 months of complimentary credit monitoring + identity protection (vendor not publicly named)
  • Dedicated hotline: 1-800-405-6108 (Monday to Friday, 8 a.m. to 8 p.m. Eastern)

Class actions

Multiple putative class actions filed in North Carolina Business Court in late March 2026. Some name affiliated hospital partners as co-defendants. Plaintiffs’ firms investigating include Lynch Carpenter, Cole & Van Note, Migliaccio & Rathod, McShane & Brady, Bryson Harris Suciu & DeMay, Gibbs Law Group.

What to do

  1. Enroll in the offered monitoring through the activation code in your letter.
  2. Place free credit freezes at Equifax, Experian, TransUnion.
  3. Cancel and reissue any bank accounts that may be tied to the financial information exposed.
  4. File IRS Form 14039.
  5. Stop the ongoing flow of your radiology and imaging-billing data. HealthConsent files HIPAA restriction requests so the demographic and referral data exposed in this breach is not continuously re-shared.

Continue reading

Stop your data from spreading further

Credit monitoring covers your wallet. HealthConsent covers your health records.

Your stolen diagnoses, test results, and medical record numbers don’t expire when the free credit-monitoring window ends. HealthConsent automates HIPAA restriction requests and opt-outs across providers, insurers, HIEs, and prescription networks so the data taken in this breach can’t keep being shared and sold by other entities downstream.

Protect my health data

Cancel anytime · Family plan covers spouses + dependents

Sources & further reading

Official HHS OCR Breach Portal: ocrportal.hhs.gov

About this page

This page is compiled from public regulatory filings, the breached entity’s own disclosures, and reporting from established healthcare-privacy outlets. Some sections are assembled with the help of automated research and may contain errors, summaries that lag the underlying source, or details that have since been revised. Treat it as a starting point, not legal advice or an authoritative record. If you spot something inaccurate, the linked sources above are the canonical record. For questions about your individual situation, contact the breached entity directly or consult a licensed attorney.