30,000-plus veterans affected by Baylor Genetics’ cybersecurity breach

Over 30,000 veterans’ health data was exposed in a June cybersecurity incident at the genetic testing laboratory Baylor Genetics, and the Department of Veterans Affairs said the company didn’t meet its notification expectations, according to an email sent by an agency official Monday and viewed by FedScoop.

Names, dates of birth, medical testing information, lab test results, health insurance data and partial Social Security numbers were accessed by an “unauthorized third party” around June 15, according to the email from the VA notifying congressional staff.

However, Baylor reported that it is “not aware of any identity theft, fraud, or misuse of personal information related to this incident at this time,” the email said.

“Upon learning of the incident, VA took immediate actions to ensure that affected Veterans are protected, by evaluating Baylor’s notification process and compliance with its contractual and security responsibilities,” it said. 

VA met with Baylor and determined the company’s initial notification and information sharing “did not meet VA’s expectations for timely, complete, and appropriately coordinated notifications,” it said, and specifically briefed providers with its Pharmacogenomics and Medical Genetics programs.

“VA worked with Baylor to improve the notification process and revised Baylor’s Interconnection Security Agreement to address delays in Baylor’s sharing of breach-related information with VA,” the email said. 

In an emailed statement, Baylor’s public relations representative Jason Maloni said the company “immediately secured our systems, engaged leading independent cybersecurity and forensic specialists, notified law enforcement, and implemented additional security measures” as lab operations continued without interruption.

“There was no impact on our ability to provide genetic testing services,” Maloni said. “We are pleased to say that our systems are operational, our environment is secure, and our important work with all stakeholders continues as usual. We have also notified potentially impacted patients and employees about the event, along with regulators.”

The VA reviewed Baylor’s incident investigation materials, prepared by Charles River Associates, and requested that the company update its Amazon Web Services S3 storage access keys, the email said. 

The agency also “advocated” for affected veterans to receive free credit-monitoring and identity-protection services through IDX, it said, and Baylor will provide a dedicated assistance line for questions. While 30,263 veterans were affected in all, 29,483 will receive mailed notices.

VA did not respond to a request for comment by the time of publication.