Myriad Genetics, a molecular diagnostic testing company headquartered in Salt Lake City, Utah, has disclosed that someone gained unauthorized access to its information technology network. The company says it detected the access on November 2, 2026, and described the incident in a filing with the Securities and Exchange Commission on November 5, 2026.
The company has not yet said whether patient information was affected, so people who have used its testing services may be looking for answers.
Myriad Genetics’s Data Breach Investigation
Myriad Genetics is a publicly traded company that provides genetic and molecular tests used in areas such as hereditary cancer risk, women’s health, and mental health care. Because its work involves laboratory orders and test results, the company holds a large amount of sensitive health-related information for patients and for the clinicians who order tests on their behalf.
On November 5, 2026, the company filed a current report on Form 8-K with the SEC to disclose a cybersecurity incident. According to summaries of that filing, Myriad Genetics detected unauthorized access within its information technology network environment. A law-firm investigation page about the incident places the detection date at November 2, 2026, and the filing’s own event date matches that day.
The filing describes what the company did next. It says it started its incident response procedures, which included containing the activity, investigating the nature and scope of what happened, and putting remedial measures in place. As part of that response, the company temporarily suspended its testing operations and its order management systems and reset certain system credentials. It also says it brought in outside experts to help with the investigation.
The company reports that most of its systems have since returned to normal operations. It also says it does not currently believe the incident will have a material adverse effect on its business. That statement is about the company’s finances and operations. It is not a statement about whether any individual’s personal information was exposed.
On that question, the public record is thin. The filing says the full extent of the unauthorized access is still under investigation, including whether any patient records were accessed on systems that hold patient information. Myriad Genetics has not said how the intruder got in, what kind of attack it was, how many people could be affected, or what types of information, if any, were taken. This page does not guess at any of those details.
Laboratories and diagnostic companies sit in the middle of a larger health care chain. A single testing company may receive orders from many clinics, hospitals, and physicians, and it may exchange data with insurers and billing vendors. That web of connections is one reason the health sector is a frequent target for network intrusions, and it is also why a disruption at one company, such as a pause in order systems, can be felt by providers and patients who never interacted with the company directly. These are general industry observations and not confirmed facts about this incident.
No notification letters to patients have been reported yet. Companies in the health sector are generally required under federal and state breach laws to notify affected people, and in many cases regulators, when protected information is confirmed to have been accessed. Those notices typically follow only after a forensic review identifies which records were involved, which can take weeks or months. If Myriad Genetics finds that patient information was affected, a notice should explain what was involved and what protection is being offered.
Health and genetic information is a common target for attackers because it cannot be changed the way a password can. When medical details are combined with identifiers such as a name, date of birth, or insurance information, they can be used for identity theft, medical identity fraud, and convincing phishing messages. Genetic testing data is especially personal, since it can describe a person’s health risks and, in some cases, information about their relatives. That is why it is worth paying attention to company updates even while the facts are still emerging.
At this stage, the most reliable guidance for anyone who has used Myriad Genetics is to watch for official communication from the company or from your health care provider, and to be careful with any unexpected message that mentions the incident. Because the investigation is ongoing, the company may release more details at any time.
When Did This Breach Occur?
Myriad Genetics says it detected the unauthorized access on November 2, 2026, and it disclosed the incident publicly in an SEC filing on November 5, 2026. The company has not said how long the intruder may have had access to its network before detection, and the investigation is still ongoing.
What Information Was Breached?
Myriad Genetics has not confirmed what information was involved. Its filing says the company is still assessing whether any patient records were accessed on systems that contain patient information, so it is not yet known whether any personal, medical, or genetic information was exposed.
If patient records were involved, the information could include details that Myriad Genetics maintains for testing and billing, but that is not confirmed. Anyone who receives a notice from the company should read it closely, because it will list the specific types of information involved in that person’s case.
What You Can Do
If you received a notice related to Myriad Genetics or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Watch for a notice from Myriad Genetics or your health care provider, and keep any letter you receive along with the enrollment details for any protection services it offers.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Myriad Genetics
People whose personal information is exposed in a data security incident may have legal options if the organization failed to use reasonable safeguards to protect it. Whether a claim exists depends on the facts, including what information was involved and how the company responded. If you are a Myriad Genetics patient or customer, or you believe your information may have been involved, you can speak with a lawyer about whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
