Lumexa Imaging Data Breach Notice (Oregon Attorney General)

The filing from Lumexa Imaging confirms that personal information belonging to 2,994 people was exposed in an incident on March 31, 2026. The organisation reported the matter to the Oregon Department of Justice on May 15, 2026 — 45 days later.

If you received a letter, this is what it actually means for you

The records included in this incident contain personal information that cannot be replaced or cancelled the way a credit card can. Once it leaves the organisation’s control, it remains usable for identity theft and fraud indefinitely. That is the core reality this filing establishes.

No passwords, no login credentials, and no permanent government identifiers such as Social Security numbers were listed in the exposed categories. This is genuinely good news. It means the breach does not put your existing accounts at direct risk of takeover through stolen credentials. The exposure is limited to the personal information category disclosed in the notification.

What the exposed personal information can still enable

Even without a Social Security number, the personal details held by a medical imaging provider can give fraudsters enough context to build convincing profiles. Medical imaging records often tie a person’s name to dates of service, procedure codes, or referring physicians. When combined with other data available on the open web or from previous breaches, this information can support synthetic identity fraud, insurance scams, or targeted phishing that appears to come from a healthcare provider you actually use.

Because Lumexa Imaging is a diagnostic imaging provider, the personal information exposed almost certainly relates to patients or their representatives. The filing does not state that clinical images or full medical histories were taken, but the simple fact that your name appears in their systems creates a permanent association between you and healthcare services that attackers can exploit for years.

The 45-day gap between incident and notification

The breach occurred on March 31, 2026. The organisation filed the notice on May 15, 2026. That six-week interval is visible on the public record. Some states allow longer periods when an investigation is still active; the filing itself does not explain the exact reason for the timing. What matters is that the information has been outside Lumexa Imaging’s control since at least the end of March.

The record does not disclose whether the data was stolen, accidentally published, or accessed by an unauthorised party. It also does not state the root cause. Those details remain unknown to the public.

How to determine whether you are one of the 2,994 affected individuals

Lumexa Imaging is required to notify affected Oregon residents directly, usually by mail to the last known address on file. If you have not received a letter, it is likely that your information was not included in this particular incident. However, if you have moved since March 31, 2026, or if your contact details on file are outdated, a letter may have gone astray. In that case, contact Lumexa Imaging directly to confirm whether you were in the affected group.

The same organisation also notified authorities in Vermont and Washington, indicating the breach was not limited to Oregon residents.

Why this exposure remains permanently sensitive

Personal information tied to healthcare encounters does not expire. A name linked to imaging services performed in 2026 can still be used in 2030 or 2035 to impersonate you in insurance disputes, to support fraudulent tax filings that reference medical deductions, or to lend credibility to phishing campaigns that reference real procedures you once had.

Because no passwords were exposed, you do not need to change any login credentials specifically because of this incident. That particular risk does not apply here. The lasting concern is the long-term misuse of the personal details themselves.

Practical steps that address this specific exposure

• Place a fraud alert with the three major credit bureaus. Even without a Social Security number listed, a fraud alert forces lenders to verify your identity before opening new accounts in your name. It is free and lasts one year (or longer if you request an extended alert).
• Review your Explanation of Benefits statements from health insurers. Look for any imaging or radiology claims you do not recognise. Medical identity theft often appears first as services billed under your insurance that you never received.
• Monitor your credit reports weekly for the next six months. Use the free weekly access now available from Equifax, Experian, and TransUnion. Look for accounts or inquiries you did not initiate.
• Treat any unexpected contact from “Lumexa Imaging” or radiology providers with caution. Verify the request by calling the organisation using a number you look up yourself rather than one provided in an email or letter.
• Consider freezing your credit if you do not anticipate needing new loans or credit lines soon. A credit freeze is more restrictive than a fraud alert but stops most new-account fraud before it starts.

The filing lists only personal information as exposed. No other categories were named. This limits the immediate scope but does not eliminate the long-term risk that comes with any healthcare-related data breach. The letter you may have received is the most reliable way to know whether your specific records were included. Where that letter does not arrive or has been lost in the mail, direct confirmation from Lumexa Imaging is the only definitive check available.