Data breach at Clinical Diagnostics bigger than anticipated, 850K patients affected

For the first time since the disclosure of the data breach, Clinical Diagnostics has announced that the scope of the recent breach is larger than expected. According to the laboratory, hackers gained access to the personal information of 850,000 patients.

Last month, the Centre for Population Screening told the media that a ransomware gang called Nova had stolen information from 485,000 participants in a cervical cancer screening program.

The threat actor obtained personal and sensitive information, including full names, gender, dates of birth, citizens’ service numbers (BSN), test results, and the names of the participants’ healthcare providers. This data was exfiltrated from an external research lab called Clinical Diagnostics.

Over 405,000 women who participated in the cervical cancer screening program have received a letter from the Centre for Population Screening, informing them about the incident.

However, the extent of the data breach is bigger than anticipated. According to Clinical Diagnostics, the data of 850,000 patients was compromised. This includes data from the Centre for Population Screening, as well as private clinics and general practitioners.

Clinical Diagnostics is sending letters to patients whose data is involved. Some of the affected patients have already been informed, while the remainder will receive personal notification in the coming weeks. Independent treatment clinics and general practitioners are informing their patients themselves.

Last Friday, the Centre for Population Screening published an update about the incident and said that the information of 715,000 participants in the cervical cancer screening program was compromised.

Since 2017, Clinical Diagnostics has processed the data of 941,000 participants in the cervical cancer screening program. As a precaution, the Centre for Population Screening has decided to send a letter to all of them.

The data breach at Clinical Diagnostics is considered one of the most severe medical breaches ever in the Netherlands. That’s why two Dutch law firms are in the early stages of filing a class-action lawsuit against the laboratory and the Centre for Population Screening.

Over 70,000 participants have already registered for a potential collective claim for damages.