HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumContained
Lumexa Imaging
bd_04a5ed3f1ab84758 · schema v1 · pii pii-v1
Full breach record for Lumexa Imaging →Lumexa Imaging, a provider of administrative services to radiology practices, notified the NH Attorney General of a breach involving a third-party vendor. Between March 31 and April 9, 2026, an unauthorized individual accessed patient records, potentially exposing names, SSNs, DOBs, and clinical data for 186 NH residents. Lumexa disconnected systems, notified the AG on June 12, 2026, and offered credit monitoring via Kroll.
This filing is one of 3 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (2) · sorted by filing gap
- bd_9572bf4fb8a30cbcWashington State AGfiled 2026-06-12Candidate
- bd_f31dffbe7cef3381Vermont State AGfiled 2026-06-12Verified
Source provenance
- Source URL
- https://mm.nh.gov/files/uploads/doj/remote-docs/lumexa-imaging-20260612.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jun 12, 2026
- Raw hash
- 80988dd3228c8a8309de7e2581465d33625c8c69d54273afc6b627c146c5a91c
Reporting entity
- Name
- Lumexa Imagingnorm: lumexa imaging
Victim entity
- Name
- Lumexa Imagingnorm: lumexa imaging
Incident
- Discovered
- Apr 15, 2026
- Materiality determined
- —
- Notification sent
- May 15, 2026
- Affected individuals
- 186
- Data types
- IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
- Attack vector
- Third-Party / Supply Chain
- MITRE ATT&CK
- T1195 Supply Chain CompromiseT1078 Valid Accounts
- Threat actor
- Partner
- Regulator citations
- Notified New Hampshire Attorney General's Office
- Initial access
- supply_chain
Compliance
- Time to disclose
- 8 weeks(58 days from discovery to filing)
- Compliance flags
- — (clock not assessable for this source)
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.