Ambry Genetics HIPAA Settlement (225k Affected)

The January 2020 phishing incident at Ambry Genetics has left 225,370 patients with their most sensitive personal and medical information permanently exposed. Names, dates of birth, Social Security numbers, addresses, financial information, medical diagnoses, and lab results were all included in the records potentially accessed through the attack.

Your Name and Date of Birth Cannot Be Changed

Unlike a credit card or password, your legal name and date of birth are fixed identifiers. Once they are paired with a Social Security number, they become a permanent key that fraudsters can use for years to open accounts, file false tax returns, or impersonate you in medical settings. This combination remains valuable long after the initial breach.

What the Exposed Medical Information Enables

The filing lists medical diagnoses and lab results alongside PHI. This data can be used to commit medical identity theft, file fraudulent insurance claims in your name, or build a detailed profile for more sophisticated scams. Because it ties directly to your healthcare history, it is especially useful to criminals targeting insurance or prescription fraud.

No Passwords or Credentials Were Exposed

This incident did not involve the exposure of Ambry Genetics account passwords. You do not need to change any password for this service as a result of this breach. That is one piece of genuinely good news in an otherwise serious exposure.

How to Determine If You Were Affected

Ambry Genetics is required to notify affected individuals directly, usually by mail. If you have not received a letter, it is likely your records were not included. However, if you have moved since January 2020, contact Ambry Genetics directly to confirm whether you were in the group of 225,370 patients whose information was potentially accessed.

The Scale of This Settlement

The U.S. Department of Health and Human Services Office for Civil Rights reached a $700,000 settlement with Ambry Genetics to resolve potential violations of the HIPAA Security Rule connected to this phishing incident. The settlement covers the exposure of protected health information belonging to more than 225,000 people.

What Remains at Risk Long-Term

Because Social Security numbers and dates of birth cannot be reissued like a compromised card, this breach creates lifelong identity theft risk. The combination of financial information with medical diagnoses further increases the chance that your records could be used for insurance fraud or to impersonate you when seeking care.

Concrete Actions That Address This Exposure

• Place a freeze on your credit reports at Equifax, Experian, and TransUnion. This prevents new accounts from being opened in your name using the exposed SSN and date of birth.
• Review every Explanation of Benefits statement from your health insurer. Look for claims you did not receive care for, as medical identity theft often appears here first.
• Set up IRS Identity Protection PIN for your tax returns. This blocks anyone from filing fraudulent returns using your SSN.
• Monitor your bank and credit card accounts closely for unusual activity, especially any transactions that could relate to medical billing or insurance.
• Contact Ambry Genetics if you moved after January 2020 and have not received notification. Confirm directly whether your records were part of the 225,370 affected.