Summit Pathology reports data breach exposing 1.8M patients
Learn More
Summit Pathology Laboratories, Inc., a Colorado-based provider of pathology services, is reporting a data breach impacting approximately 1,813,538 patients.
The breach, confirmed in Summit’s report to the Department of Health and Human Services' Office for Civil Rights (OCR), resulted from a cyberattack in April 2024. Summit Pathology detected suspicious activity in its network on April 18, 2024, and responded to secure its systems, enlisting a third-party cybersecurity firm to assess the breach's scope and nature.
The Medusa ransomware group claimed responsibility for the attack, which was triggered when an employee inadvertently opened a malicious attachment in a phishing email. The hackers gained access to files containing highly sensitive patient information, including:
- Names
- Addresses
- Dates of birth
- Social Security numbers
- Financial information
- Health insurance information
- Billing details
- Medical data, including diagnoses
Summit Pathology is offering free identity theft protection services through IDX, a data breach and recovery specialist. Affected individuals are entitled to:
- 12 or 24 months of credit and CyberScan monitoring, depending on their state of residence
- A $1,000,000 identity theft insurance policy
- Fully managed identity theft recovery services
