Baylor Genetics: ePHI of 2.8M Patients Exposed in Cybersecurity Incident
On August 19, 2026, we reported on a cybersecurity incident at the clinical genomics company Baylor Genetics. At the time, it was clear that this was a significant breach, based on reports submitted to state attorneys general; however, the scale of the breach was unknown.
The Baylor Genetics data breach has recently been added to the HHS’ Office for Civil Rights website, which shows that the electronic protected health information (ePHI) of 2,810,878 individuals was exposed or stolen in the incident.
August 19, 2026: Patient & Employee Data Exposed in Baylor Genetics Cybersecurity Incident
Baylor Genetics, a clinical diagnostic genomics company, has recently disclosed a cybersecurity incident that has exposed patient and employee data. The incident was first announced in June; however, the extent of the data breach was unclear at the time.
Baylor Genetics provides genetic testing services to hospitals and is headquartered at the Texas Medical Center in Houston. The company identified suspicious activity within its computer network on or around June 15, 2026. Immediate action was taken to secure its systems, and an investigation was launched to determine the cause of the activity. The investigation determined that an unauthorized third party accessed a portion of its information technology network between June 11 and June 17, 2026, and viewed or obtained data stored on the network.
Assisted by third-party cybersecurity specialists, Baylor Genetics conducted a detailed and time-intensive review of all potentially impacted files. The review was completed on July 30, 2026, when it was confirmed that the personal information of certain patients and employees was involved. The types of data involved varied from individual to individual and may have included names plus one or more of the following: date of birth, medical testing information, lab test results, health insurance information, and for a limited subset of patients, Social Security numbers.
Employee data was also exposed in the incident, including personally identifying information such as Social Security numbers, government-issued identification numbers, and financial account information. While data was exposed and potentially exfiltrated, Baylor Genetics is unaware of any actual or attempted identity theft, fraud, or other misuses of the impacted data.
Baylor Genetics said the incident did not impact its laboratory operations, which continued without interruption throughout the investigation, and there was no impact on the company’s ability to provide genetic testing services. Baylor Genetics has enhanced its security and monitoring controls, strengthened identity and access management, and has implemented additional security controls to prevent similar incidents in the future. Complimentary credit monitoring and identity theft protection services have been offered to at least some patients.
The data breach has been reported to regulators; however, it is currently unclear how many patients and employees had data compromised in the incident. What is known is that almost 250,000 Texas residents, around 57,000 Massachusetts residents, and 2,630 Vermont residents have been affected, bringing the total to around 310,000 patients. Other states, such as California, have been notified that some state residents have been affected, so the final victim count is likely to be considerably higher.
