“medical data from more than 16 million scans worldwide was available online, including names, birthdates and, in some cases, Social Security numbers.”