Baylor Genetics, the laboratory testing firm whose services span clinical and genomic diagnostics, said hackers accessed part of its network between June 11 and June 17. The company described the incident as touching a limited slice of its technology environment, with certain individuals’ personal information involved. Potentially exposed patient data includes birth dates, medical and laboratory test records, and health insurance information, plus Social Security numbers in a very limited number of cases; employee data affected includes Social Security numbers and financial account information.
The investigation, run with third-party experts and law enforcement, wrapped up July 30. Baylor Genetics has started notifying affected individuals, says it has seen no confirmed identity theft, fraud, or misuse tied to the incident, and found no evidence that test results were altered. It has since strengthened identity and access management and added other controls.
Diagnostic vendors hold large volumes of genomic and clinical data and connect to hundreds of providers, which makes them attractive targets. Recent incidents at Centers Lab and Abbott show the same dynamic: an attack on a vendor that providers depend on for testing or devices. Providers should scrutinize lab partners’ access controls, data segmentation, and breach notification timelines before signing contracts, rather than learning them from a notice letter.
