A Tennessee pathology lab breach affecting more than 169,000 patients has exposed Social Security numbers and detailed clinical records five months after investigators first detected the intrusion. Anatomic and Clinical Laboratory Associates began its probe on December 1, 2025, after anomalous activity was spotted on its network, and wrapped up the forensic review on April 27, 2026. By that point, investigators had confirmed that attackers exfiltrated files containing names, dates of birth, taxpayer IDs, and medical data including diagnoses, treatment procedures, and patient account numbers. The practice has not said when the criminals first broke in or how long they moved undetected through its systems.
Notification letters began reaching patients on June 23, and those whose Social Security numbers were exposed are receiving complimentary credit monitoring and identity theft protection services. The practice said it has implemented additional security controls but did not detail the specific changes. The disclosure adds to a year that is already shaping up to be one of the worst for healthcare data breaches, with 281 healthcare compromises recorded in H1 2026 alone and the overall breach count across all industries on pace to exceed 3,600.
