Colorado-based pathology service provider Summit Pathology Laboratories has reported a significant data breach affecting 1,813,538 patients following a cyberattack in April 2024. The company disclosed the incident to the US Department of Health and Human Services’ Office for Civil Rights (OCR), detailing the alarming scope of the attack, which involved unauthorized access to sensitive patient information.

The breach was detected around April 18, 2024, when suspicious activity was observed within Summit Pathology’s computer systems. The company swiftly took measures to secure its environment and engaged a third-party cybersecurity firm to investigate the breach’s nature and extent.

According to Summit Pathology, cybercriminals accessed files that included a trove of personal data. A review of the compromised files revealed that they contained names, addresses, dates of birth, Social Security numbers, financial information, health insurance details, billing information, medical records, and diagnoses. In a statement on its website, Summit Pathology emphasized its commitment to mitigating the impacts of such cyberattacks and improving its data protection protocols.

Following a breach, the company has notified law enforcement and reviewed its data security policies to ensure they align with industry best practices. Summit Pathology has also introduced additional administrative and technical safeguards to thwart future incidents. To support affected patients, the company offers credit monitoring and identity theft protection services, including a US$1 million insurance policy.

While the breach notice did not specify the incident’s details, a legal representative for Summit Pathology has indicated that the Medusa ransomware group was responsible for the attack. This incident reportedly began when an employee inadvertently opened a malicious attachment in a phishing email. Though the attorney did not confirm whether a ransom was paid, there are currently no listings for Summit Pathology on the Medusa data leak site, known for publicly disclosing data of victims who do not comply with ransom demands.