Central Kentucky Radiology (CKR), a physician-owned radiology group based in Lexington, Kentucky, has experienced a data breach affecting 166,953 individuals. The cybersecurity incident was disclosed to the U.S. Department of Health and Human Services on June 13, 2025.
Central Kentucky Radiology discovered a network disruption on October 18, 2024. An investigation determined that between October 16 and October 18, 2024, an unauthorized actor accessed and copied files from certain CKR systems. The compromised files contained information related to patient billing.
Compromised information included personally identifiable information (PII) and protected health information (PHI). Breached information may have included name, address, date of birth, Social Security number, date of medical service, and service charge.
On May 7, 2025, CKR completed a review and began notifying impacted patients by mail on June 12, 2025. The data breach was disclosed to the Maine, Vermont and New Hampshire Attorney Generals' offices on June 13, 2025, with a reported 20 Massachusetts residents, 8 New Hampshire residents and three Mainers affected.
The cybersecurity incident was also reported to the Massachusetts Attorney General's office on June 17, 2025. Central Kentucky Radiology published a Notice of Data Security Event on its own website.
CKR secured its systems to prevent further access and launched an investigation. Affected individuals and regulatory authorities are being notified, as required by law.
If you receive a data breach notification from Central Kentucky Radiology, you may want to:
Central Kentucky Radiology has also set up a dedicated assistance line at 1-833-566-6360, available Monday through Friday from 8:00 am to 8:00 pm.
For more information about the company, visit Central Kentucky Radiology’s website.