Cyber attack on Lexington Diagnostic Center impacted about 30,000 patients

Lexington, Kentucky-based independent medical imaging facility, Lexington Diagnostic Center, said that the data security incident it suffered last year compromised the sensitive personal information of almost 30,000 individuals.

 

In a data security incident notification, Lexington Diagnostic Center said that on March 16, it identified unauthorised access to its internal network. The health service provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“Although the forensic investigation determined our electronic health records system was not affected by the incident, the investigation subsequently determined that certain files from an archived file server may have been accessed or removed from our network between February 26, 2024 and March 16, 2024,” the diagnostics provider said.

 

The compromised data included names, addresses, phone numbers, dates of birth, Social Security numbers, medical record numbers, patient account numbers, health plan beneficiary numbers, geographic location data, medical diagnosis and medical treatment information.

 

In a filing with the U.S. Department of Health and Human Services, LDC said that it has identified at least 29,819 individuals who were impacted by the data security incident.

 

“LDC is committed to maintaining the privacy of personal information in its possession and has taken many precautions to safeguard it. LDC continually evaluates and modifies its practices to enhance the security and privacy of the personal information it maintains,” the firm added.

 

While LDC found no evidence of the compromised information being misused, it has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services to individuals whose social security number was compromised during the incident.