Radiology Associates of San Luis Obispo, a healthcare provider, suffered a data breach after an unauthorized actor accessed employee email accounts between February 3, 2025, and March 17, 2025. The breach exposed personally identifiable information (PII) and protected health information (PHI) of at least 13,158 individuals, including names, addresses, dates of birth, Social Security numbers, driver’s license copies, medical records, imaging records, and payment details (card numbers and CVV codes). The incident was reported to the U.S. Department of Health and Human Services (HHS) and the California Attorney General as a hacking/IT incident. The organization responded by resetting passwords, updating security policies, and offering 12 months of free credit monitoring (TransUnion Cyberscout) to affected individuals. A dedicated helpline was also established for support. The breach posed risks of identity theft, financial fraud, and phishing attacks due to the sensitivity of the exposed data, particularly in the healthcare sector where PHI is highly regulated under HIPAA.