If you've ever had blood work, a diagnostic test, or a lab panel ordered through certain healthcare providers on the East Coast, there's a decent chance your information passed through a company called Centers Laboratory — and that company just confirmed hackers had access to its systems for nearly a week last year, walking away with Social Security numbers, driver's license details, and full medical records for over half a million people.
What Actually Happened
Centers Laboratory, a New Jersey-based diagnostics and lab testing provider for healthcare organizations, discovered an intrusion into its IT systems in August 2025. The investigation found that attackers had access between August 9 and August 14 of that year, exfiltrating data before the breach was even detected on August 25. A group calling itself WorldLeaks claimed responsibility, saying it pulled roughly 720 gigabytes of data — an unusually large haul for a single lab provider, and one that suggests the intruders had time to move through the system largely undetected. Formal notification to regulators and the public didn't happen until June 2026, nearly a year after the intrusion began.
What Information Was Actually Exposed
This isn't a breach limited to email addresses or login credentials. According to the official notification, the compromised data includes:
- Full names and dates of birth
- Social Security numbers
- Driver's license or state ID numbers
- Passport numbers
- Health insurance details and medical records
The federal healthcare breach tracker maintained by Health and Human Services now lists the confirmed total at 542,377 individuals. Not everyone affected will have had every category of data exposed — the exact combination depends on the individual notification letter each person receives.
Why This Breach Is More Dangerous Than a Typical Password Leak
A leaked password can be changed in thirty seconds. A stolen Social Security number combined with your date of birth and medical history cannot be reset the same way, and it can be used for years afterward to open fraudulent credit accounts, file fake tax returns, or commit medical identity theft, where someone else's treatment ends up on your insurance record. That last risk is particularly disruptive, since it can lead to incorrect information appearing in your own medical files.
How to Check If You're Affected
Centers Laboratory is required to send individual written notification to everyone whose data was confirmed exposed. If you've had lab work done through a provider that used Centers Laboratory's testing services, watch your mail and email for an official notice. You can also review confirmed healthcare breach disclosures directly through the Department of Health and Human Services breach reporting portal, which tracks incidents of this size as they're formally logged.
What to Do If You Receive a Notification Letter
- Place a credit freeze with all three bureaus — Equifax, Experian, and TransUnion. It's free and stops new accounts from being opened in your name.
- Enroll in any credit monitoring or identity restoration service the company offers in its notification letter, typically at no cost to you.
- Pull your credit report through annualcreditreport.com and check for anything unfamiliar.
- Watch your health insurance statements closely for medical services or claims you don't recognize, since medical identity theft doesn't always show up on a standard credit report.
- Be alert to phishing attempts that reference the breach directly — scammers often follow major breach news with fake "verification" emails.
Do You Have Legal Options?
Breaches involving Social Security numbers and medical records at this scale frequently lead to class action lawsuits, particularly given the year-long gap between discovery and public notification. Consulting a data breach or consumer protection attorney is a reasonable step if you want to understand whether you qualify for any compensation, especially if you can show direct financial harm, such as fraudulent charges or new accounts opened in your name.
Frequently Asked Questions
How do I know if my specific data was involved?
Only an official notification letter from Centers Laboratory can confirm which categories of your data were affected. If you're unsure whether a provider you used relied on this lab, contact your healthcare provider directly.
Why did it take almost a year to notify people?
The company has not publicly detailed the full reason for the delay, though breach investigations of this size — determining exactly whose data was taken and coordinating with regulators — commonly take many months before formal notification goes out.
Is a credit freeze enough to protect me?
A credit freeze protects against new account fraud but doesn't prevent medical identity theft or misuse of an existing account. Monitoring your insurance and medical statements separately is still important.
Can I join a lawsuit even if I haven't lost money yet?
Many data breach class actions accept plaintiffs based on exposure risk alone, not just proven financial loss, though outcomes vary by case. An attorney can clarify your specific standing.
If you've ever had lab work done through a provider on the East Coast in the past few years, it's worth a few minutes today to check your mail for a notification letter — and to freeze your credit either way.
