Ambry Genetics Corporation

HHS OCR settled with Ambry Genetics Corporation for $700,000 following a phishing attack that exposed the health data of approximately 225,000 patients. The case highlights risks associated with phishing attacks in healthcare.

Ambry Genetics Corporation notified the NH Attorney General of a data security incident where an unauthorized third party gained access to one business email account via a successful phishing attack between January 22-24, 2020. The incident potentially impacted health-related information, social security numbers, and other personal information of 675 New Hampshire residents. Ambry contained the incident, implemented enhanced authentication, and offered 12 months of identity protection services.

Ambry Genetics Corporation reported a phishing attack on January 22, 2020, resulting in unauthorized access to a business email account between Jan 22-24, 2020. The incident impacted 2,152 Washington residents, exposing health-related information, SSNs, and other personal data. Ambry engaged outside experts, enhanced authentication, and offered 12 months of identity protection services.

Ambry Genetics Corporation reported a data breach to the Indiana Attorney General. The breach occurred on 2020-01-22 and was reported on 2020-04-17. 3,267 Indiana residents were affected. 232,772 individuals affected in total.

Ambry Genetics notified Montana residents of a security incident involving unauthorized access to an employee email account between Jan 22-24, 2020. The incident likely resulted from phishing. Personal information may have been disclosed. The company engaged outside experts and offered free identity monitoring services.

Ambry Genetics Corporation reported unauthorized access to an employee's email account between January 22-24, 2020. The investigation could not determine if specific information was acquired, but personal information may have been disclosed. The company engaged outside experts, enhanced security measures, provided employee training, and offered free identity monitoring services to affected individuals.

Ambry Genetics Corporation reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-04-17. 5,437 Massachusetts residents were affected. The report records the breach type as electronic.

Ambry Genetics Corporation, a California-based healthcare provider specializing in genetic testing, reported to HHS OCR on 2020-03-22 a Hacking/IT Incident affecting 225,370 individuals. Breached information was located in Email systems. No business associate was identified as present. Given Ambry's focus on genetic testing, health genetic data is likely among the data types affected alongside standard health and identity information.

AMBRY GENETICS COPORATION filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-173). The register records the breach as discovered on January 22, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.