A Rochester, New York mobile diagnostic service has put a number on a summer break-in. UltraMobile Imaging told regulators that 75,000 people had protected health information exposed after an intruder sat inside parts of its network on July 30, 2026. Outside forensics confirmed the access was limited in duration. The notice does not say when the intrusion was detected.
The record set is broad for a mobile imaging shop: names, contact details, birth dates, diagnoses, lab results, medications, service dates, CPT codes, ordering physician names, claims data, and financial account numbers. Credit monitoring was not offered, which will draw scrutiny given the banking data in play.
Three smaller notices in the same batch
A Longmont, Colorado dental practice trading as Artistic Smiles traced a June 21 detection to a week of access beginning June 14. About 3,735 patients are affected, and the Nightspire extortion crew has listed the practice on its leak site, though ransomware is unconfirmed.
In Chesapeake, Virginia, the Cognitive Behavior Therapy Center is dealing with a vendor problem. Billing contractor Express Billing Systems found an intruder on August 24 and determined files were copied. Roughly 1,500 patients are affected, and some have been contacted directly by the attacker to demand money – the extortion-after-theft pattern that turns a vendor breach into a patient-facing crisis.
The fourth notice is operational. Parkview Health in Fort Wayne, Indiana is still recovering from an October 19 outage that knocked out MyChart and appointment reminders. The portal is back; video visits and billing are not. The nonprofit has not said whether data left the network.
Where the risk sits
Two of the four are third-party failures, one with direct patient extortion. Audit billing vendors for segmentation and ask, in writing, who pays when their intrusion reaches your patients.
