Radiology Associates of Richmond Data Breach: Two Breaches, Two Lawsuits
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
Radiology Associates of Richmond (RAR), a Virginia imaging practice, has disclosed two separate breaches, and each has its own federal class action. The first, from April 2024, affected about 1.42 million people; the parties reported a settlement in January 2026, but as of October 13, 2026 we found no settlement website, claim form or deadline. The second Radiology Associates of Richmond data breach, from July 2025, affected 266,183 people, with letters mailed starting May 21, 2026. That case is still being fought.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Lawsuits Say Happened
RAR is a private radiology practice headquartered in North Chesterfield, Virginia, and one of the oldest continuously operating radiology practices in the U.S. It reads scans for hospitals and imaging centers in the Richmond area, so it holds patients' identity, insurance and health records.
Breach one (April 2024). According to RAR's disclosure, an unauthorized actor got into a network server over a few days in April 2024. RAR found out in May 2025. Letters went out starting around July 1, 2025. RAR reported about 1.42 million affected people to HHS. One complaint alleges RAR knew of the breach since May 2, 2025 but did not notify anyone until July 1, 2025. It lists name, phone number, Social Security number and driver's license or ID number as exposed.
Breach two (July 2025). RAR says an unauthorized actor got into its network on or about July 25, 2025. Its investigation concluded on or about April 6, 2026 that files with protected health information were taken. Filings with state attorneys general list Social Security numbers, government ID numbers, medical and health-insurance details, and financial account or card information. RAR says it has no evidence of misuse.
In both cases, the lawsuits allege that RAR failed to use reasonable cybersecurity. RAR has not admitted this.
Case Details
Both cases are in the U.S. District Court for the Eastern District of Virginia, before District Judge David J. Novak.
Case one: In re Radiology Associates of Richmond Data Breach Litigation, Master File No. 3:25-cv-00518. Judge Novak consolidated nine suits into it on August 6, 2025. Plaintiffs filed a consolidated complaint on October 22, 2025, and RAR moved to dismiss on December 5, 2025.
Case two: In re Radiology Associates of Richmond Data Breach Litigation II, No. 3:26-cv-00470. It combines Adair (3:26-cv-00470), Cason (3:26-cv-00472) and Butler (3:26-cv-00491), consolidated on June 8, 2026. A separate suit, Bias v. Radiology Associates of Richmond, Inc., No. 3:26-cv-00692, was filed on July 17, 2026.
Status: One Reported Settlement, One Live Fight
Case two (2025 breach): pretrial, no settlement. RAR moved to dismiss on August 21, 2026. Under the court's schedule, plaintiffs had to respond by October 5, 2026, and RAR's reply is due by October 26, 2026. There is no fund, no claim form and no deadline.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Which Breach Are You In?
Your letter answers this. A letter from around July 2025 is about the April 2024 breach. Those people are the proposed class in case one, the case with the reported settlement. A letter dated May 21, 2026 or later is about the July 2025 breach and case two. Some patients may have received both.
You do not have to sign up to be in either proposed class. If the court approves the case-one settlement, a court-appointed administrator will contact class members using RAR's records. Keep your letter and its envelope, because they show which breach you were in and what data was exposed.
What a Case Like This Pays
For context only, not as a prediction: a Paubox report says another radiology group, Consulting Radiologists in Minnesota, settled a breach affecting over 500,000 people for $2.2M. Healthcare-breach settlements usually offer reimbursement of documented losses, a smaller flat payment and credit monitoring. With about 1.42 million people in case one, any per-person flat payment would be split many ways.
Radiology Associates of Richmond Breach Timeline
- 1
April 2024 — First Intrusion
An unauthorized actor gets into an RAR network server over a few days. RAR discovers it in May 2025.
- 2
July–August 2025 — Letters and Lawsuits
Notices go out starting around July 1, 2025, and suits follow from July 7. On August 6, 2025, the court consolidates them as No. 3:25-cv-00518.
- 3
July 25, 2025 — Second Intrusion
According to RAR's notice, an unauthorized actor gets into its network again. This becomes the second breach.
- 4
January 28, 2026 — Settlement Reported in Case One
Plaintiffs file a notice of settlement. On January 29, 2026, the court stays deadlines and orders an approval motion by March 30, 2026.
- 5
May 21, 2026 — Second Breach Notified
RAR mails letters to 266,183 people. Suits follow from May 27, and on June 8, 2026 they are consolidated as No. 3:26-cv-00470.
- 6
August–October 2026 — Motion to Dismiss
RAR moves to dismiss case two on August 21, 2026. Plaintiffs' response was due October 5, 2026, and RAR's reply is due October 26, 2026.
Three Things to Watch For
Two breaches, two cases and a reported settlement with no public details is exactly the kind of confusion scammers use:
“Claim your RAR settlement payment” sites
As of October 13, 2026, we found no court-approved claim form for either case. A real notice will name the court and case number 3:25-cv-00518. A site that asks for your Social Security number now is collecting data, not filing a claim.
Calls or emails about your RAR letter
Someone who knows you were a patient can sound convincing. To check, call the toll-free line on RAR's own notice page (1-877-512-7109), not a number from an email or text.
“Join the settlement” ads for the 2025 breach
The reported settlement is in case one, which covers the April 2024 breach. The July 2025 breach is in a separate case with no settlement. An ad that mixes up the two is not a reliable source.
Radiology Associates of Richmond Breach — Questions People Ask
Is there a Radiology Associates of Richmond data breach settlement?
Only in case one, the April 2024 breach, and it is not open for claims. A notice of settlement was filed January 28, 2026, and the court ordered an approval motion by March 30, 2026. As of October 13, 2026, we found no approval order, settlement website, claim form or deadline. Case two, the July 2025 breach, has no settlement.
Are data breach letters legit?
RAR's letters about the second breach started going out on May 21, 2026. Letters about the first breach started around July 1, 2025. RAR posts its notice at rarichmond.com and runs a toll-free line, 1-877-512-7109, weekdays 8 am to 8 pm Eastern. To check a letter, compare it with that page and call that number. Do not use contact details printed in an email.
How many people were affected?
About 1.42 million people in the April 2024 breach, according to the HHS breach tracker. The July 2025 breach affected 266,183 people, according to RAR's filing with the Maine Attorney General.
What information was exposed?
In the first breach, a complaint lists name, phone number, Social Security number and driver's license or ID number. For the second, state filings list Social Security numbers, government ID numbers, medical and health-insurance details, and financial account or card information. Your letter says which of these applied to you.
How much compensation do you get for a data breach?
There is no figure for RAR yet, because the case-one settlement terms are not public and case two is unresolved. In comparable healthcare breaches, people with receipts for documented losses usually get the most, and flat payments are usually small. The data breach settlement calculator explains how these payments are usually split.
Do I need to do anything now?
You do not need to join anything. If the case-one settlement is approved, class members will be sent notice. If your Social Security number was exposed, sign up for the free credit monitoring RAR offered, and consider a credit freeze. Also check your explanation-of-benefits statements for care you never received.
What is the latest update on the lawsuit?
As of October 13, 2026: in case one (No. 3:25-cv-00518), the parties reported a settlement and the court stayed the case, but no approval is public. In case two (No. 3:26-cv-00470), RAR's motion to dismiss filed August 21, 2026 is being briefed, with RAR's reply due October 26, 2026.
Is this the same as the Radiology Partners lawsuit?
No. The defendant in both Richmond cases is Radiology Associates of Richmond, Inc., a single Virginia practice. This page covers only those cases. For another company's lawsuit, look up that company's own case.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements currently accepting claims, with deadlines
Data Breach Settlement Calculator
Estimate what a data breach settlement could pay you
Settlement Payout Calculator
How pro rata class action payouts are actually divided
Aesto Health Data Breach
Another healthcare breach lawsuit tracked in 2026