Find notable cyber news and cases, enriched with sources, timelines, and signals.

SimonMed Imaging patient data leak

Data Leak
First reported
Last updated
Happening score
H score 27
1 unique sources, 1 articles

Summary

Hide ▲

SimonMed Imaging exposed patient and medical records after attackers leaked sample files tied to a January breach, increasing privacy and identity-theft risk for more than 1.2 million individuals. The leaked proof material included ID scans, patient details, payment details, account balances, medical reports, and raw scans. The disclosure adds data-exposure harm on top of the underlying intrusion and suggests sensitive clinical and financial information may have been taken. The company said it had no evidence of misuse as of October 10.

Related Happenings

The Gentlemen internal back-end database leak sale

Data Leak
First: 13.05.2026 23:47 Last: 13.05.2026 23:47 Sources 1

About this happening: On or just before **May 4, 2026**, the ransomware gang **The Gentlemen** suffered a **breach of its internal back-end database**, and attackers began **selling more than 16GB** of...

BlackFile victims' Salesforce and SharePoint data leak

Data Leak
First: 24.04.2026 21:26 Last: 24.04.2026 21:26 Sources 1

About this happening: BlackFile's **stolen documents** were published on a **dark web leak site**, exposing employee and business records taken from **Salesforce** and **SharePoint** environments. The...

Cookeville Regional Medical Center patient records leak

Data Leak
First: 16.04.2026 18:01 Last: 16.04.2026 18:01 Sources 1

About this happening: **Cookeville Regional Medical Center** disclosed a **data leak** affecting **337,917 patients**, exposing personal and medical records and raising identity-theft risk. Files were...

INC New Zealand healthcare data leak

Data Leak
First: 12.03.2026 00:00 Last: 12.03.2026 00:00 Sources 1

About this happening: **INC** stole and later published data from a **healthcare organization in New Zealand**, exposing a large amount of information and escalating the event from intrusion to leak pu...

Conduent hit by network compromise

Incident
First: 10.02.2026 19:04 Last: 10.02.2026 19:04 Sources 1

About this happening: **Conduent** disclosed a **security breach** affecting its **IT systems** between **October 21, 2024** and **January 13, 2025**. Threat actors stole **full names**, **Social Secur...

Timeline

  1. 13.10.2025 23:12 1 articles · 7mo ago

    Unauthorized access begins at SimonMed Imaging

    Exploitation Observed

    Hackers had unauthorized access to SimonMed Imaging systems beginning on January 21, marking the start of a reported compromise window that later was described as lasting through February 5.

    Show sources
  2. 13.10.2025 23:12 2 articles · 7mo ago

    Vendor alert leads SimonMed Imaging to investigate

    Initial Disclosure

    A vendor alerted SimonMed Imaging that it was experiencing a security incident, and SimonMed learned of the breach on January 27 before starting an investigation.

    Show sources
  3. 13.10.2025 23:12 1 articles · 7mo ago

    SimonMed Imaging adds containment and monitoring controls

    Mitigation Patch Update

    By the next day, SimonMed Imaging had confirmed suspicious activity on its network and moved to contain the compromise by resetting passwords, enabling multifactor authentication, adding endpoint detection and response (EDR) monitoring, removing third-party vendors' direct access, and restricting inbound and outbound traffic to trusted connections.

    Show sources
  4. 13.10.2025 23:12 1 articles · 7mo ago

    Medusa ransomware claims SimonMed Imaging attack

    Attribution Update

    Medusa ransomware announced SimonMed Imaging on its extortion portal on February 7, claimed it had stolen 212 GB of data, and demanded a $1million ransom plus $10,000 for a one-day extension before publishing the stolen files.

    Show sources
  5. 13.10.2025 23:12 1 articles · 7mo ago

    SimonMed Imaging says no evidence of misuse by October 10

    Victim Impact Update

    SimonMed Imaging said as of October 10 that it had no evidence the accessed information had been misused for fraud or identity theft, and it offered affected letter recipients a free subscription to identity theft services through Experian.

    Show sources