A 2026 cyberattack on Radiology Associates of Richmond exposed names and medical information. If you received a notice, here's what it means — and what you can do.
Per the company's filing — only the items below were involved. We don't pad the list.
Medical records are among the most sensitive personal data that exist. Unlike a leaked password, exposed medical history cannot be "rotated" — a diagnosis, prescription history, or treatment record stays sensitive for life and can affect insurance, employment, and personal privacy.
Medical data is also valuable to identity thieves. It can be combined with other exposed identifiers to commit medical identity theft — filing fraudulent insurance claims, obtaining prescriptions, or even contaminating a victim's medical records with someone else's history.
Regardless of any legal action, if you received a notice there are protective steps worth taking:
Hosted copy of the notice filed with the Maine Attorney General (original PDF on maine.gov).

A class action investigation is underway. If you received a notice, you may be eligible — find out in two minutes. There’s no cost and no obligation.
An investigation into a potential class action is underway. Whether a suit is ultimately filed depends on the facts and on counsel's assessment. Signing up registers your interest and lets attorneys evaluate eligibility — it is not itself a lawsuit.
Class action representation in cases like this is typically handled on a contingency basis, meaning no upfront cost to you. Always confirm terms directly with the representing attorneys.
If you received a notification letter from Radiology Associates of Richmond, you were among those identified as affected. If you're unsure, the letter is the definitive indicator.