More than 30,000 veterans had health data exposed in a June cybersecurity incident at genetic testing laboratory Baylor Genetics, and the Department of Veterans Affairs said the company did not meet its notification expectations, according to an email sent by a VA official Monday.
Names, dates of birth, medical testing information, lab test results, health insurance data and partial Social Security numbers were accessed by an “unauthorized third party” around June 15, the email notifying congressional staff said.
Baylor reported that it is “not aware of any identity theft, fraud, or misuse of personal information related to this incident at this time,” the email said.
“Upon learning of the incident, VA took immediate actions to ensure that affected Veterans are protected, by evaluating Baylor’s notification process and compliance with its contractual and security responsibilities,” the email said.
Baylor Genetics cybersecurity breach: VA response and notifications
The VA said it met with Baylor and determined the company’s initial notification and information sharing “did not meet VA’s expectations for timely, complete, and appropriately coordinated notifications,” and specifically briefed providers with its Pharmacogenomics and Medical Genetics programs. The agency worked with Baylor to improve the notification process and revised Baylor’s Interconnection Security Agreement to address delays in Baylor’s sharing of breach-related information with VA.
The VA reviewed Baylor’s incident investigation materials, prepared by Charles River Associates, and requested that the company update its Amazon Web Services S3 storage access keys, the email said. The agency also “advocated” for affected veterans to receive free credit-monitoring and identity-protection services through IDX. Baylor will provide a dedicated assistance line for questions.
A total of 30,263 veterans were affected, the email said; 29,483 of those veterans will receive mailed notices.
Baylor’s response and operational status
In an emailed statement, Baylor public relations representative Jason Maloni said the company “immediately secured our systems, engaged leading independent cybersecurity and forensic specialists, notified law enforcement, and implemented additional security measures” as lab operations continued without interruption. Maloni added, “There was no impact on our ability to provide genetic testing services.” He said, “We are pleased to say that our systems are operational, our environment is secure, and our important work with all stakeholders continues as usual. We have also notified potentially impacted patients and employees about the event, along with regulators.”
The VA confirmed the validity of the email but did not comment further.
