Lumexa Imaging reports vendor-related data incident

Lumexa Imaging has disclosed a vendor-related data privacy incident involving information from affiliated radiology practices and imaging centers.

The vendor notified Lumexa on April 9 that it was investigating suspicious activity in part of its network dedicated to those affiliated practices and imaging centers. Lumexa said it immediately disconnected its systems from the vendor’s network.

On April 15, Lumexa learned that an unauthorized person may have viewed or obtained copies of documents containing patient information from part of the vendor’s system. The documents were taken between March 31 and April 9, according to the patient notice.

Potentially involved data varied by document and individual. It may have included names, dates of birth, addresses, phone numbers, patient account numbers, insurance information, visit dates, diagnoses, and other health information related to radiology services. A limited number of patients may also have had Social Security numbers involved.

Before reconnecting systems to the vendor’s network, the vendor reported that it had taken remediation steps. Those included password resets, scrubbing and validation of affected systems, and enhanced cybersecurity monitoring and detection tools.

Lumexa said it had no evidence that the information had been misused. The notice said individuals whose Social Security numbers were impacted would receive complimentary credit monitoring services.

The number of individuals affected is currently unknown, according to Schubert Jonckheer & Kolbe LLP, which said it is investigating the incident. The law firm said the vendor connection may have been used to view or obtain documents associated with Lumexa’s affiliated radiology practices.