StrataDx data breach

What we know

StrataDx operates at the critical intersection of modern medicine and specialized pathology, providing advanced diagnostic testing, clinical laboratory services, and specialized anatomical pathology evaluations to physicians, hospitals, and healthcare networks. Because of the sophisticated nature of their clinical operations, StrataDx routinely collects, processes, and stores vast quantities of highly sensitive Protected Health Information (PHI) and Personally Identifiable Information (PII). This repository includes intricate medical histories, diagnostic test results, tissue and biopsy records, billing details, and foundational demographic data necessary for patient identification and insurance processing. The sheer volume and deeply personal nature of the records entrusted to StrataDx make its digital infrastructure an attractive target for malicious cybercriminals seeking to exploit vulnerable healthcare data systems. In 2026, StrataDx formally reported a major cybersecurity incident to the New Hampshire Attorney General's office, alerting regulatory authorities and the public to an unauthorized compromise of its network environment. While specific forensic details continue to emerge, data security incidents affecting specialized medical diagnostic providers typically involve sophisticated ransomware deployments, unauthorized intrusion into centralized clinical databases, or compromised third-party vendor conduits. In the healthcare sector, threat actors frequently target legacy systems or exploit vulnerabilities in administrative network perimeters, exfiltrating vast archives of confidential files before security teams can detect and isolate the intrusion. The data compromised in the StrataDx security incident exposes individuals to severe, long-term risks that extend far beyond standard financial identity theft. Because diagnostic laboratories manage clinical data, exposed records frequently include full names, dates of birth, Social Security numbers, health insurance policy numbers, specific diagnostic codes, treatment histories, and physician notes. The unauthorized disclosure of medical record information is particularly insidious; unlike a compromised credit card, an individual cannot cancel or replace their medical history or genetic profile. This sensitive data can be weaponized by bad actors to commit medical fraud—such as obtaining unauthorized prescription drugs, illicitly billing insurance providers for unrendered treatments, or accessing specialized clinical care under a victim's identity—leaving patients to navigate tangled medical records and erroneous health histories. Under federal and state law, diagnostic laboratories like StrataDx have rigorous, non-negotiable legal obligations to safeguard sensitive consumer and patient data. As an entity handling Protected Health Information, StrataDx is governed strictly by the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules, alongside state-level data protection statutes and consumer protection laws enforced by the Federal Trade Commission. These regulatory frameworks require entities to implement robust administrative, physical, and technical safeguards, including multi-factor authentication, continuous network monitoring, rigorous vendor risk management, and regular vulnerability assessments. The occurrence of a widespread data breach strongly suggests a potential failure of these mandatory security obligations, raising serious questions regarding whether the company maintained adequate defenses to prevent unauthorized network access. Receiving an official data breach notification letter from StrataDx serves as formal legal confirmation that your confidential records were exposed during the security incident. Under modern class action jurisprudence, the receipt of such a letter provides affected individuals with the necessary legal standing to pursue a class action lawsuit against the responsible organization. Plaintiffs do not need to demonstrate that they have already suffered actual financial loss or medical identity theft to participate in litigation; the increased, imminent risk of future fraud and the unauthorized exposure of private data are sufficient grounds to seek legal redress. Our firm is actively investigating potential class action claims on behalf of individuals affected by the StrataDx data breach, handling all cases on a contingency fee basis, meaning there are no upfront costs or out-of-pocket expenses for class members unless a recovery is successfully obtained.

See every breach reported in New Hampshire or read what to do after a ransomware attack.