Pinehurst Radiology Associates
Pinehurst Radiology cyberattack halts imaging services
Summary
Pinehurst Radiology Associates closed after a cybersecurity incident halted imaging appointments and left systems offline. Its later notice dated discovery to around Jan. 20, 2025. A patient letter confirmed closure effective June 1; restoration of the original practice is not established.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Data exposure
Data was made accessible to unauthorized parties through misconfiguration, system compromise, improper access controls, or another unintended condition.
Operational impacts
-
Complete service outage
A primary service, system, platform, or operational capability became entirely unavailable.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Scheduling disruption
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
-
Healthcare operations disrupted
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Pinehurst Radiology Associates in North Carolina closed its outpatient practice after a cybersecurity incident disrupted its systems. The practice’s May 22, 2025, patient notice dates discovery of suspicious network activity to around Jan. 20. The exact first unauthorized access and the start of the clinical interruption are not established.
The initial closure was publicly reported by Feb. 5. Contemporaneous coverage reproducing the practice’s statement said systems remained offline and offices would stay closed until further notice. The practice retained legal counsel and cybersecurity specialists and notified law enforcement.
Operational significance
The interruption prevented mammography and ultrasound scheduling. Patients were told to contact their referring providers, while those needing PET or MRI scans were directed to First Imaging. FirstHealth of the Carolinas expanded capacity to accommodate patients; its separate systems were reported unaffected. March 12 reporting documented continuing closure and offline systems.
A subsequent patient letter dated June 1 confirmed that the practice closed effective that day. It urged patients to establish care elsewhere and identified a new medical-records custodian. Operational status is resolved on this confirmed cessation, rather than on evidence that the original practice restored services.
July reporting distinguished the property sale from acquisition of the practice and noted a new similarly named corporate registration. Continued use of the Pinehurst Radiology name does not establish recovery of the affected company.
Confidence and uncertainty
The practice’s statements support high confidence in a cyber-related interruption. Its breach notice says an unauthorized person may have acquired information, including identity, medical and insurance data, with Social Security numbers involved in limited cases. The affected information varied by person. Completion of the data review on April 7 was not a restoration milestone.
The reviewed notices do not establish ransomware, an identified attacker, a ransom demand or payment. The notice reported no known fraudulent misuse at that time. The closure letter confirms cessation but does not establish that the cyberattack was its sole cause.
Analytic gaps
The entry route, precise access period, technical recovery history and incident-specific losses remain unverified. Later litigation and patient notification are separate from the operational timeline. A current website or a scheduled settlement hearing does not independently establish the original practice’s restoration or final court approval.
Organizations involved
Impacted location
Pinehurst, North Carolina
Pinehurst is the verified municipality of the affected outpatient practice at 30 Memorial Drive. The practice acknowledged offline systems and an inability to schedule mammography and ultrasound. This physical location does not imply an outage across the village or surrounding Moore County.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.