Lumexa Imaging Data Breach — Case File

From the AG filing description

Lumexa Imaging operates as a specialized diagnostic imaging and radiology provider, delivering essential medical imaging services such as MRIs, CT scans, X-rays, and ultrasounds to patients across South Carolina. Because the company routinely coordinates with referring physicians, hospitals, and health insurance networks, it functions as a central repository for vast amounts of sensitive protected health information. The enterprise must collect, process, and store extensive patient files to facilitate accurate diagnostic reporting, billing operations, and insurance pre-authorizations, making its digital infrastructure a dense archive of highly personal records. In 2026, Lumexa Imaging formally reported a significant security incident to the South Carolina Attorney General, indicating that unauthorized actors may have infiltrated its digital environment. In the healthcare sector, breaches of this magnitude typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized database intrusions, or vulnerabilities within third-party vendor networks used for picture archiving and communication systems (PACS). These incidents often expose the vulnerabilities inherent in managing interconnected medical networks, where legacy systems and vast troves of patient data create lucrative targets for cybercriminals seeking to extort organizations or harvest marketable data. The exposure of medical and personal data resulting from a healthcare industry breach creates profound risks for affected individuals. Compromised records typically include full names, dates of birth, Social Security numbers, medical record numbers, health insurance policy details, diagnostic imaging reports, and clinical treatment histories. Unlike static credentials such as passwords, immutable medical data and Social Security numbers cannot simply be changed after a breach. This exposes victims to long-term threats including medical identity theft—where unauthorized parties fraudulently obtain medical services or bill insurance under a victim's name—as well as targeted phishing schemes, fraudulent insurance claims, and comprehensive financial fraud. As a covered entity handling protected health information, Lumexa Imaging was bound by strict regulatory standards under the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, and applicable South Carolina data privacy statutes. These laws mandate rigorous administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of electronic health data. The occurrence of a data breach suggests potential shortcomings in these mandatory security protocols, raising serious questions regarding whether the organization maintained adequate encryption, intrusion detection, and access controls commensurate with the sensitivity of the medical data it held. Receiving an official data breach notification letter from Lumexa Imaging serves as formal legal acknowledgment that your confidential information was compromised due to corporate security failures. Legally, the receipt of this notice establishes standing to participate in a class action lawsuit aimed at holding the organization accountable for failing to safeguard sensitive data. Importantly, victims do not need to prove that they have already suffered out-of-pocket financial loss or medical fraud to seek legal redress; the increased, imminent risk of future identity theft and the invasion of privacy are sufficient grounds for legal action. Our firm evaluates and litigates these claims on a strict contingency fee basis, meaning affected individuals pay nothing out of pocket, and we only recover fees if a successful recovery is secured on your behalf.