Medical Lab Hack Affects Planned Parenthood Patients

A laboratory that provides medical testing services to Planned Parenthood clinics in 31 states is notifying 1.6 million patients, workers and those who paid for healthcare on behalf of another person that their sensitive personal and health information was accessed or removed in an October 2024 hacking incident.

See Also: Top 10 Technical Predictions for 2025

Seattle, Washington-based nonprofit Laboratory Services Cooperative reported the incident to regulators Thursday. In a breach notice, the cooperative said it is “encouraging individuals to take precautionary measures to protect their information” following the data security incident that affected a wide variety of information.

Laboratory Services Cooperative says it provides – or at some point in the past provided – medical testing services for certain Planned Parenthoods clinics that offer in-person and telehealth visits.

Depending upon an affected individuals’ state of residence, the organization is offering 12 to 24 months of complimentary identity and credit monitoring services. The cooperative has also set up a call center to help individuals determine whether a particular Planned Parenthood health center uses the firm for lab testing services.

Breach Details

Laboratory Services Cooperative said that on Oct. 27, 2024, it identified suspicious activity within its network. The cooperative said it immediately engaged third-party cybersecurity specialists to determine the nature and scope of the incident and notified federal law enforcement.

“The investigation revealed that an unauthorized third-party gained access to portions of LSC’s network and accessed/removed certain files belonging to LSC,” the cooperative said.

The cooperative also hired cybersecurity professionals to monitor dark web forums, marketplaces and other platforms for any LSC information that has been accessed or stolen. So far, the experts have not found any evidence that the affected information has turned up on the dark web, LSC said.

Information compromised varies among individuals but potentially includes name, address, phone number, email address, dates of service, diagnoses, treatment, medical record number, lab results, patient number, provider name, treatment location and related-care details.

Also potentially compromised is health insurance and financial information such as plan name, plan type, company name, member and group ID numbers. Among the billing and payment data potentially affected are claim numbers, billing details, bank name, account number, routing number, as well as billing codes, payment card details, balance details, similar banking and financial information.

Other identifiers potentially compromised includes Social Security numbers, driver’s license or state ID number, passport number, date of birth, demographic data, student ID number and other government identifiers.

For employees, the affected information may also include details about dependents or beneficiaries.

Planned Parent clinics in 30 states plus Washington D.C. are among those affected. Others includes California, Kansas, Texas and Washington state.

An attorney representing Laboratory Services Cooperative in its breach report did not immediately respond to Information Security Media Group’s request for additional details about the incident, including whether a ransom was demanded or paid in exchange of cybercriminals promising not to leak LSC’s stolen data.

Top Concerns

A worrisome aspect of the Laboratory Services Cooperative hack is the nature of the data stolen, said Fred Langston, executive vice president of professional services at security firm Lumifi Cyber. The affected information “is highly personal and with the potential to negatively impact the reputation of persons whose data was stolen and exposed,” he said.

“More concerning is how data brokers will buy this data once it hits the dark web and then ‘wash’ the data into a larger data set that is put up for sale,” he said.

“One fear is that some state governments are currently using this data from Planned Parenthood to identify and investigate individuals who use some of Planned Parenthoods services,” including abortions, which are now illegal in those jurisdictions, he said.

Regulatory attorney Rachel Rose said the sensitive reproductive information compromised in the attack is troublesome for several reasons.

“The main issues that stand out are the potentially higher black-market value and violation of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy,” involving the affected information, she said (see: HHS Beefs Up Privacy Protections for Reproductive Health Info).

HHS OCR last year enhanced regulatory privacy safeguards around reproductive health information disclosures, so cyberincidents like the one at Laboratory Services Cooperative could potentially run afoul of that. However, some states – mostly where abortion is banned or strictly limited – have sued HHS looking to have the modified rule revoked (see: 15 States Sue HHS to Drop HIPAA Reproductive Health Info Reg).

“This type of attack underscores the importance of adhering the technical, administrative and physical safeguards of the Security Rule and conducting an annual risk analysis, as well as ensuring that the definition of ‘reproductive health care’ is understood and the related HIPAA Reproductive Privacy Rule’s requirements are implemented,” Rose said.

Also when it comes to cyberincidents involving any medical testing laboratories, besides data privacy concerns there are also potential risks involving data integrity and accuracy.

In attacks like these, “modification of data could easily be a concern, such as changing positive pregnancy tests into negative ones,” Langston said. “Lab equipment is a common attack target since medical devices are favorite targets for installation of unauthorized cryptominers,” he said. “We urge our customers to include validation of medical devices functionality post-breach.”

Rose offered a similar assessment. “The most common worries are confidentiality, integrity and availability of the data,” she said. “When I handle post-incident scenarios, especially in healthcare, we always focus on the integrity of the data. If the integrity has been adulterated, then portions could be missing or facts could have been changed. In turn, this can lead to inaccurate treatment protocols,” she said.

Labs could be forced to redo tests, and they could face higher damages in court “because of the heightened sensitivity of the information,” she said.