Baylor Genetics Cyberattack Exposes Sensitive Patient Data — What the Healthcare Industry Should Learn
A cyberattack on Baylor Genetics, a major U.S. genetic-testing and diagnostics company, may have exposed highly sensitive patient information, including medical records, insurance details and, in a small number of cases, Social Security numbers.
The incident is another reminder that healthcare cybersecurity is no longer just about protecting hospitals. Companies that process laboratory results, genetic information and other medical data are becoming increasingly valuable targets for attackers.
What Happened at Baylor Genetics?
Baylor Genetics said attackers gained access to part of its information technology environment between June 11 and June 17.
According to the company, the breach affected only a limited portion of its systems, but some personal information belonging to patients and employees may have been accessed.
Baylor Genetics provides laboratory and genomic testing services to healthcare organizations. Because of that role, the company handles large amounts of sensitive information.
Potentially exposed patient information included:
- Dates of birth
- Medical information
- Laboratory test records
- Health insurance information
- Social Security numbers in a very limited number of cases
Some employees may also have had information exposed, including Social Security numbers and financial account details.
The Good News: Test Results Were Not Altered
One major concern in attacks involving diagnostic companies is whether hackers could manipulate medical information.
Baylor Genetics said its investigation found no evidence that patient test results were changed or modified.
That distinction is important.
Stealing patient information can lead to identity theft, insurance fraud and privacy violations. But altering laboratory or genetic-test results could potentially create an even more dangerous situation by affecting medical decisions.
For now, Baylor says it has not found evidence of that happening.
The company also said it was not aware of any confirmed identity theft, fraud or misuse of personal information connected to the breach at the time of its announcement.
Baylor Brought in Cybersecurity Experts
Following the attack, Baylor Genetics hired third-party cybersecurity professionals and worked with law enforcement to investigate the incident.
The investigation was completed on July 30.
The company then began notifying individuals whose information may have been compromised.
Baylor also said it strengthened its cybersecurity defenses after the attack, including improvements to its identity and access management systems.
However, the company did not publicly explain exactly how the attackers gained access to its network or provide extensive details about the security changes it implemented.
Why Genetic Information Is Especially Sensitive
A breach involving a genetic-testing company can be particularly concerning because genetic and medical information is very different from something like a stolen password.
Passwords can be changed.
Credit cards can be canceled.
But a person’s genetic information cannot simply be replaced.
Genetic records can potentially reveal information about inherited health conditions, biological relationships and other deeply personal medical characteristics.
That makes companies storing genomic information attractive targets for cybercriminals.
It also means healthcare organizations must treat genetic and laboratory data as some of the most sensitive information inside their systems.
The Bigger Problem: Healthcare Supply-Chain Cybersecurity
The Baylor Genetics breach highlights a much larger cybersecurity challenge facing healthcare organizations.
Hospitals and clinics increasingly rely on outside companies for services such as:
- Laboratory testing
- Medical devices
- Billing
- Cloud storage
- Electronic health records
- Diagnostic imaging
- Prescription processing
- Genetic testing
Every outside company with access to patient information can potentially become another entry point for attackers.
A hospital may invest heavily in cybersecurity, but patient information can still be exposed if one of its vendors has weaker defenses.
This is known as third-party or supply-chain cybersecurity risk.
And it is becoming one of the biggest challenges facing the healthcare industry.
Medical Vendors Are Attractive Targets
Healthcare technology vendors can be particularly valuable to cybercriminals because a single company may work with hundreds or even thousands of healthcare providers.
Instead of attacking hospitals individually, attackers may target one vendor that holds information belonging to patients from many different organizations.
That can dramatically increase the amount of information available from a single successful intrusion.
Recent attacks involving diagnostic and medical-technology companies show why healthcare organizations need to pay closer attention to the cybersecurity practices of the companies they work with.
What Healthcare Organizations Should Learn
The biggest lesson from the Baylor Genetics incident is simple:
Cybersecurity does not stop at your company’s network.
Healthcare organizations should carefully evaluate every third-party provider that handles sensitive patient information.
That means organizations should:
Strengthen identity and access controls
Sensitive systems should require strong authentication, limited user permissions and continuous monitoring.
Multi-factor authentication should be standard for employees and contractors accessing critical systems.
Limit access to patient information
Employees and vendors should only have access to the information required to perform their jobs.
Reducing unnecessary access can limit the damage if an account becomes compromised.
Monitor third-party vendors
Healthcare organizations should evaluate the security practices of companies that process or store patient information.
Vendor cybersecurity should be reviewed continuously rather than only when a contract is signed.
Encrypt sensitive information
Patient, financial and genomic information should be encrypted wherever possible, both when stored and while being transmitted.
Prepare for breaches before they happen
Organizations should have documented incident-response procedures covering detection, investigation, communication, regulatory reporting and recovery.
Companies that prepare in advance are usually able to respond more effectively when an attack occurs.
What Patients Should Do After a Healthcare Data Breach
Anyone notified that their information was affected by a healthcare breach should take the notification seriously.
Depending on the type of information exposed, affected individuals may want to:
- Monitor financial and insurance accounts.
- Review medical statements for unfamiliar activity.
- Change passwords connected to affected services.
- Enable multi-factor authentication where available.
- Watch for phishing emails pretending to come from healthcare providers.
- Consider credit monitoring or a credit freeze if Social Security information was exposed.
One important warning is that criminals frequently use information from previous breaches to create highly believable phishing attacks.
An email that includes a person’s real healthcare provider, date of birth or insurance information can appear legitimate even when it is fraudulent.
What This Means for Businesses
The Baylor Genetics breach should also get the attention of companies outside healthcare.
Modern businesses rely heavily on third-party software providers, cloud platforms, payment processors and specialized vendors.
Your organization’s security can therefore depend on companies you don’t directly control.
Businesses should know:
Who has access to their data, what information those companies hold and how those companies protect it.
Vendor risk management is quickly becoming just as important as protecting internal networks.
The Bigger Picture
Cybercriminals increasingly understand that valuable information does not always sit inside banks or technology companies.
Healthcare organizations hold some of the most personal data available anywhere.
Genetic information makes that data even more sensitive.
The Baylor Genetics incident shows why healthcare cybersecurity must extend beyond hospitals and doctors’ offices to the laboratories, technology providers and medical vendors supporting them.
For patients, the concern is privacy.
For healthcare companies, the challenge is trust.
And for the cybersecurity industry, the lesson is becoming increasingly clear:
Protecting healthcare data means securing the entire healthcare supply chain — not just the hospital at the center of it.
Aqyreon Takeaway
Healthcare cybersecurity is becoming a supply-chain problem.
Organizations can spend millions securing their own infrastructure and still suffer a major breach because of a vulnerable outside provider.
As healthcare becomes more connected and more patient information moves between laboratories, cloud platforms, medical devices and software providers, organizations need to treat third-party cybersecurity as a core business risk rather than an IT checklist item.
