Balance Diagnostics Imaging Services Breach (2025): Patient SSN & Home Address Exposed

About Balance Diagnostics

Balance Diagnostics is a U.S.-based medical imaging and diagnostics services provider, headquartered in Cedarhurst, New York. The company offers medical imaging services typical of a regional outpatient diagnostic provider, including radiology, ultrasound, and related testing services for referring physicians and patients. As a HIPAA-regulated healthcare provider, Balance Diagnostics maintains patient identity, contact, insurance, billing, and diagnostic-imaging records, alongside referral relationships with primary care and specialty practices across its service area. Patient relationships are typically transactional and tied to specific referrals rather than long-term care, which influences how the practice handles longitudinal records.

Why They Hold Your Data

Diagnostic and testing providers collect patient identity, contact, insurance, billing, appointment, and test-related medical records across clinical and administrative workflows.

Recent Developments

Balance Diagnostics was attacked on May 6, 2025 by the Everest ransomware gang. Initial data samples appeared on dark-web leak pages immediately after the incident, and the full dataset of approximately 31,000 records was released on June 18, 2025 after ransom demands went unmet. The practice has not publicly disclosed extensive operational detail about the incident as of this writing. The Everest gang has been an active extortion group throughout 2024 and 2025 with multiple healthcare-sector victims. Class-action investigations by U.S. plaintiff law firms followed the dataset release in mid-2025. HHS Office for Civil Rights review obligations apply.

Data Points Exposed

Breach Impact

The institutional impact on Balance Diagnostics is meaningful given the practice's regional scale relative to the breach. Federal HIPAA notification obligations, an Office for Civil Rights review, attorney-general filings, and active class-action investigations are all underway. The Everest gang's release of the full dataset rather than holding it in private extortion creates direct evidence of broad data exposure and strengthens future litigation. Operationally, the practice continues to provide imaging services. Reputational exposure is concentrated within the regional referring-physician network, where breach handling can affect referral relationships and ongoing patient acquisition.

Exploitation & Downstream Threats

• Identity theft and synthetic identity construction using government-issued IDs | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
2. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
3. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
4. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).