Radiology services provider Central Kentucky Radiology (CKR) is notifying roughly 167,000 people that their personal information was compromised in an October 2024 data breach.
The incident, the organization says, was discovered after certain systems within its network were disrupted by a cyberattack.
CKR determined that a threat actor had access to its network between October 16 and October 18, 2024, and copied files from its systems.
On May 7, 2025, the healthcare organization completed its review of the stolen files and determined that they contained personal information such as names, addresses, dates of birth, Social Security numbers, dates of medical service, and service charges.
Central Kentucky Radiology says it notified the relevant authorities and law enforcement of the incident, and on June 13 started mailing written notification letters to the impacted individuals.
“While we are unaware of any actual or attempted fraudulent misuse of your information as a result of this incident, we are notifying you out of an abundance of caution,” reads a copy of the notification letter submitted to the Vermont Attorney General’s Office.
The health services provider notified the US Department of Health and Human Services that 166,953 individuals were affected by the incident. CKR is providing them with 12 months of free credit monitoring services.
“Additionally, CKR is providing impacted individuals with guidance on how to better protect against identity theft and fraud, including advising individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank,” CKR told the Maine Attorney General’s Office.
The organization has not shared details on the type of cyberattack it fell victim to, but the network disruption suggests that ransomware might have been involved. SecurityWeek has not seen any known ransomware group claiming responsibility for the incident.
Related: Mainline Health, Select Medical Each Disclose Data Breaches Impacting 100,000 People
Related: 743,000 Impacted by McLaren Health Care Data Breach
Related: Data Breach at Healthcare Services Firm Episource Impacts 5.4 Million People
Related: Asheville Eye Associates Says 147,000 Impacted by Data Breach
