Ambry Genetics ambrygen.com Ambry Genetics data breach: what happened and what to do
An attacker got into an Ambry Genetics employee's email account between January 22 and 24, 2020. The breach was reported to HHS as affecting 225,370 people. Reports say names, addresses, dates of birth, medical details and, for some people, Social Security numbers were involved.
View all 13,177 breaches- Breach date
- 22 Jan 2020
- Made public
- 17 Apr 2020
- Affected
- 225,370
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Ambry Genetics, a genetic testing lab in California, found suspicious activity in an employee's email account on January 22, 2020. An outside party had reached the account after the employee responded to a phishing email, and had access to it until January 24, according to news coverage of the company's notice. Ambry could not confirm whether anyone viewed or took specific information.
The account held patient details. Reports say that included names, addresses, dates of birth, driver's license numbers, diagnosis and treatment information, medications, and Social Security numbers for some people. Ambry told patients in April 2020 and offered free identity monitoring.
The breach was reported to the U.S. Department of Health and Human Services as affecting 225,370 people. Early press reports gave a slightly higher figure of 232,772, so you may see both numbers.
This kind of data is useful to scammers. A name, date of birth and Social Security number are enough to try opening credit in your name. Details about a medical condition make phishing messages and calls more convincing, for example a fake call from a lab or insurer.
A class action followed, and Ambry agreed to a settlement fund of about $12.25 million, per press reports.
Sources checked: ocrportal.hhs.gov, hipaajournal.com, healthitsecurity.com
Last verified against the official page:
What to do if you were in it
- 1
Read the notice you were sent
If you were a patient, Ambry should have written to you. The letter says which of your details were involved and how to enroll in the free monitoring.
- 2
Freeze your credit at all three bureaus
A credit freeze is free and stops new accounts being opened with your Social Security number. You place it separately with Equifax, Experian and TransUnion, and you can lift it temporarily when you apply for credit. The FTC explains how at consumer.ftc.gov. A freeze doesn't stop charges on accounts you already have.
- 3
Watch for medical and insurance statements you don't recognize
Check explanation-of-benefits statements for care you didn't receive. If something looks wrong, report it to your insurer and file a report at IdentityTheft.gov.
- 4
Be wary of calls and messages about your test results
Scammers use medical details to sound credible. Don't give out personal information to someone who contacts you first. Call the lab or your insurer on a number you look up yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email address or phone number.
Official filings
- U.S. Department of Health and Human Services , filed 22 Mar 2020 : 225,370 people
Timeline
-
The breach happened
-
Reported to U.S. Department of Health and Human Services
-
The company made it public
Frequently asked
Was I affected by the Ambry Genetics data breach?
If you were a patient in early 2020, you may have been. Ambry sent notice letters starting in April 2020. If you didn't get one, contact Ambry directly.
What information was exposed?
Reports based on Ambry's notice list names, addresses, dates of birth, driver's license numbers, diagnosis and treatment information and medications, plus Social Security numbers for some people. Ambry could not confirm that anyone viewed specific data.
Is there a settlement?
Yes. Press reports say Ambry agreed to a settlement fund of about $12.25 million to resolve a class action over the breach.
Should I freeze my credit?
If your Social Security number may have been involved, the FTC says a free credit freeze at Equifax, Experian and TransUnion is a strong step against new-account fraud.
Sources
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- hipaajournal.com/233000-patients-notified-about-phi-breach-at-genetic-testing-lab/
- healthitsecurity.com/news/ambry-genetics-reaches-12.25m-settlement-over-healthcare-data-breach
- consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts
- identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
