Pierluigi Paganini
April 11, 2025
Laboratory Services Cooperative disclosed a data breach that impacted the personal and medical information of 1.6 million people.
The Laboratory Services Cooperative (LSC) is a clinical laboratory based in Bremerton, Washington, providing diagnostic testing services primarily to Planned Parenthood centers across 31 U.S. states. Their services support reproductive health and other medical testing needs.
The incident took place in October 2024, LSC is notifying impacted individuals. The company did not provide details about the attack.
On October 27, 2024, the Laboratory Services Cooperative detected suspicious network activity and launched an investigation with the help of cybersecurity experts. They found that an unauthorized party accessed and removed files. A third-party vendor was engaged to assess the impacted individuals.
The stolen data from the LSC breach may include names, addresses, phone numbers, and emails, as well as medical information (diagnoses, lab results, treatment details), health insurance details (plan info, member IDs), billing and payment data (bank account and card info), and sensitive identifiers like Social Security numbers, driver’s license or passport numbers, dates of birth, and student or government IDs.
“The specific information involved is not the same for everyone.” reads the notice of data breach. “It depends on the individual’s relationship with LSC but may include contact details such as name, address, phone number, and email, along with one or more of the following categories:
For LSC workers, the breach may also include information about their dependents or beneficiaries, if such details were provided to LSC.
The incident did not impact all Planned Parenthood centers, the security breach only those that used lab testing services from LSC may have been impacted.
The company provides impacted individuals with 12 or 24 months of free credit monitoring and medical identity protection services through CyEx Medical Shield Complete.
After detecting suspicious activity, LSC acted swiftly to investigate and secure its systems. They hired cybersecurity experts to monitor the dark web, but so far, no evidence suggests that stolen data has surfaced there.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Laboratory Services Cooperative)
