Prime Imaging was listed on the Everest ransomware group's leak site on January 12, 2024, with the attackers giving the medical imaging company just 24 hours to contact them or face full publication of stolen internal files.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Primeimaging
Get alerted the next time Primeimaging files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Primeimaging’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Details from the Leak Site
The Everest ransomware leak site states that Prime Imaging suffered a ransomware attack in which internal files were exfiltrated. The listing explicitly warns that the company has the last 24 hours to reach out using instructions left by the operators. It further notes that silence will result in all data being published at the provided link to primeimaging.com. The disclosure does not quantify how many records were taken, name specific file types beyond "internal files," or list individual data elements such as patient records or employee information. Public reporting on Everest typically shows that such countdowns precede either partial samples or full data dumps on their onion site.
Why This Matters for You and Your Family
When a medical imaging provider loses control of internal files, the exposure can directly affect patients and their households. Medical imaging records often contain names, dates of birth, addresses, Social Security numbers, insurance details, and clinical images that can be used for identity theft or insurance fraud. Even if the exact volume of affected records remains unknown, any family member who had scans, X-rays, or MRIs performed at Prime Imaging could have their personal health information now sitting in criminal hands. The short 24-hour ultimatum increases the chance that the data will be released publicly, turning a corporate incident into a personal privacy crisis for anyone whose records were stored there.
The Doxxing and Identity-Chain Risks
Exfiltrated internal files frequently include spreadsheets that link patient identities to email addresses, phone numbers, and sometimes even login credentials for patient portals. Once published, these details feed directly into doxxing chains: attackers or opportunistic criminals combine the leaked data with information from other breaches to map out full identities, target family members, or hijack accounts. Credential leaks of this nature routinely cascade into gaming account takeovers, especially for children and teenagers whose usernames and passwords are reused across entertainment platforms and school-related services. The public nature of the Everest leak site means the data can be downloaded by anyone, multiplying the speed and scale of downstream abuse.