Onsite Mammography, a Massachusetts-based provider of in-office breast health services, has reported a major data breach that compromised the sensitive personal information of over 350,000 patients.
The breach was first identified in October 2024 when the company uncovered unauthorized access to a staff member’s email account. Following an internal investigation, the healthcare provider confirmed in February 2025 that the exposed inbox contained a significant amount of personal and health-related data.
The compromised details reportedly include full names, Social Security numbers, dates of birth, driver’s license numbers, credit card data, and highly sensitive medical records — such as patients’ physical and mental health conditions and the treatments they received.
According to Onsite Mammography, the breach was limited to a single email account. They emphasized that no other systems within their broader network were accessed. The company has since notified 357,265 individuals and is offering one year of free identity protection and credit monitoring services to those affected.
While Onsite Mammography stated it has no evidence that the stolen data has been misused, the healthcare firm has not disclosed who was behind the breach or whether there was any ransom demand or extortion attempt.
The breach has been officially reported to the Maine Attorney General’s Office, as required by law. Still, many details remain unclear, including how the attacker gained access and the full scope of the vulnerability that was exploited.
Operating under the Onsite Women’s Health brand, the company delivers services like 3D mammography, Whole-Breast Ultrasound imaging, and breast cancer risk assessments to clinics and medical facilities nationwide. This breach raises fresh concerns about how medical institutions safeguard patient data—especially as threats to healthcare cybersecurity continue to rise.
