SimonMed Imaging Data Breach — Class Action Review

SimonMed Imaging operates as one of the largest outpatient medical imaging and radiology providers in the United States, offering advanced diagnostic services such as MRIs, CT scans, ultrasounds, and X-rays. Because of its vital role in clinical care, the organization collects and maintains vast repositories of sensitive records for millions of patients. This includes high-resolution medical imagery, comprehensive diagnostic reports, referring physician notes, and detailed administrative billing files. To operate efficiently and coordinate care with other medical professionals, SimonMed must retain comprehensive personal and clinical histories, making it a centralized hub for highly confidential information.

In 2025, SimonMed Imaging reported a significant cybersecurity incident to the New Hampshire Attorney General's office. While the precise mechanics of the intrusion continue to be evaluated, security events affecting major healthcare networks typically involve sophisticated cyberattacks such as ransomware deployments, unauthorized exfiltration of corporate databases, or compromises within third-party vendor ecosystems. In the healthcare sector, malicious actors frequently target legacy infrastructure and administrative networks to intercept unencrypted data packets or lock systems down for extortion. This incident highlights the vulnerability of interconnected medical systems and the persistent threat posed by well-funded cybercriminal syndicates.

The breach exposed a deeply sensitive mix of personally identifiable information and protected health information, creating severe, multi-faceted risks for affected individuals. The compromise of full names, dates of birth, and Social Security numbers leaves victims exposed to lifelong risks of identity theft and synthetic fraud. Furthermore, the exposure of medical record numbers, health insurance details, and specific diagnostic or treatment information creates unique dangers, including medical identity theft, fraudulent insurance claims, and the potential unauthorized disclosure of private health conditions. When medical data is compromised, victims face the alarming prospect of receiving fraudulent bills, having their medical histories altered by third parties, or having their confidential health details exploited in targeted phishing schemes.

As a healthcare provider, SimonMed Imaging is bound by strict federal and state regulatory frameworks, most notably the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules, alongside state consumer protection and data security statutes. These legal mandates require covered entities to implement robust administrative, physical, and technical safeguards—such as end-to-end encryption, multi-factor authentication, continuous network monitoring, and rigorous vendor risk management—to prevent unauthorized access to electronic protected health information. The occurrence of a widespread data breach strongly suggests potential failures or deficiencies in these required security protocols, raising serious questions about whether the organization met its statutory duties to protect patient data.

For individuals who have received an official data breach notification letter from SimonMed Imaging, this correspondence serves as formal acknowledgement that their private information was compromised due to corporate security shortcomings. Legally, the receipt of this notice establishes the concrete injury and standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Affected individuals do not need to wait until financial fraud or medical identity theft actually occurs to take legal action. Our firm evaluates these cases on a contingency fee basis, meaning clients pay absolutely nothing out of pocket, and we only collect a fee if we successfully recover compensation on your behalf.