---
title: "Data breach at Ambry Genetics Corporation"
description: "In January 2020, an Ambry Genetics employee's email account, a US genetic testing laboratory, was compromised in a phishing attack. Protected health information of 225,370 individuals was potentially exposed, including names, addresses, dates of birth, Social Security or driver's license numbers, fi"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-17-ambry-genetics-corporation
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-17
dateModified: 2026-09-17
---
# Ambry Genetics Corporation

Data breach — Critical

In January 2020, an Ambry Genetics employee's email account, a US genetic testing laboratory, was compromised in a phishing attack. Protected health information of 225,370 individuals was potentially exposed, including names, addresses, dates of birth, Social Security or driver's license numbers, financial information, diagnoses, lab results and treatment information. On September 17, 2026, HHS' Office for Civil Rights announced a $700,000 settlement with Ambry Genetics for HIPAA Security Rule violations, including a failure to conduct a risk analysis and to manage workforce access.

The combination of identity, financial and health data exposes affected individuals to a high risk of identity theft and health-insurance fraud.

| Fact | Value |
| --- | --- |
| Disclosed on | September 17, 2026 |
| Accounts affected | 225,370 |
| Sector | Healthcare |
| Country | United States |
| Cause | Phishing |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Full name
- Postal address
- Date of birth
- Social security number
- Identity document
- Banking data (IBAN, card)
- Health data

## What you can do

- Watch your statements. On any unknown debit, block the card and request a refund — French law (art. L133-18) entitles you to it.
- These documents enable identity theft, and cannot be reissued at will. Keep the notification letter: it proves where the leak came from if an account is opened in your name.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [HHS’ Office for Civil Rights Settles HIPAA Investigation of Ambry Genetics for Security Rule Violations](https://databreaches.net/2026/09/18/hhs-office-for-civil-rights-settles-hipaa-investigation-of-ambry-genetics-for-security-rule-violations/) — DataBreaches.net
- [HHS' Office for Civil Rights Settles HIPAA Investigation of Ambry Genetics Phishing Attack Affecting 225,000 Individuals](https://www.hhs.gov/press-room/hhs-office-civil-rights-settles-hipaa-investigation-ambry-genetics-phishing-attack-affecting-225000-individuals.html) — HHS.gov
- [Ambry Genetics Pays $700,000 Penalty to Settle HIPAA Violations](https://www.hipaajournal.com/ambry-genetics-hipaa-penalty/) — HIPAA Journal
- [Ambry Genetics Reaches $12.25M Settlement Over Healthcare Data Breach](https://www.techtarget.com/healthtechsecurity/news/366593991/Ambry-Genetics-Reaches-1225M-Settlement-Over-Healthcare-Data-Breach) — TechTarget

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-17-ambry-genetics-corporation
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees