HackingHealthcareHealthcareCapture Stored DataData ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIPIIGovernment IDMediumContained

Expert MRI

bd_afa81d482c249306 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Mar 23, 2026

To disclose

—

Affected

Not disclosed

Linked

3 records

Confidence

78%

Full breach record for Expert MRI →

Expert MRI, a medical imaging provider based in Bellflower, CA, experienced unauthorized access to its systems between August 14–24, 2025, discovered on September 2, 2025. An unknown actor accessed and copied files containing protected health information including names, dates of birth, and potentially driver's license/state ID numbers. Expert MRI secured its systems, notified federal law enforcement, reviewed impacted files, and is offering complimentary credit monitoring via Epiq.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Aug 14, 2025

Begins

Mar 23, 2026

Filed

This filing is one of 3 records about the same incident.View merged incident

A leak claim by pear about this victim was first seen 190 days before this filing.View originating leak claim

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitepearbd_34c64136786d19982025-09-02 · +202dCandidate

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_2b130423bbc6b21a2025-10-31 · +143dVerified

Name: Expert MRI
norm: expert mri
Domain: expertmri.com

Name: Expert MRI
norm: expert mri
Domain: expertmri.com
Industry: Healthcarellm

Discovered: —
Breach occurred: Aug 14, 2025 – Aug 24, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIPIIGovernment ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated CollectionT1074 Data Staged
Threat actor: External
Regulator citations: Notified federal law enforcement

During the incident: Took steps to secure the network
Launched an extensive investigation to determine the nature and scope of the event
Reported this event to federal law enforcement and supported their investigation
Conducted an extensive review of impacted files to determine if any sensitive information could be affected
Notified applicable authorities, as required by law
Sent notification letters to affected individuals
Changes made: Reviewed existing policies and procedures and added additional safeguards
Providing access to complimentary credit monitoring and identity restoration services through Epiq
Source: Quoted from the filing itself, not independently verified.

Compliance flags: Leak >180d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCROct 31 · first

California State AG+143d · this page

Pattern: first filing Oct 31 (CA), last Mar 23 (CA) — a 143-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-620694
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 23, 2026
Raw hash: f763e52a1ef1763604eb4e428cdf7675fd1c08a82cae97e3be62500dba4b481b

Linked disclosures

Ransomware claims (1)

Regulatory filings (1) · sorted by filing gap

Reporting entityExpert MRI

Victim entityExpert MRI

IncidentUnauthorized Access

Stated responseTook steps to secure the network

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov