Insomnia ransomware group announces major data theft from Tennessee pathology lab

Tennessee-based Anatomic and Clinical Laboratory Associates said a data security incident it suffered last year compromised the sensitive personal information of its patients and staff.

 

Anatomic and Clinical Laboratory Associates is a Nashville, Tennessee-based physician-owned clinical laboratory that provides diagnostic testing and pathology services to healthcare providers.

 

In a data security incident notice published on its website, ACLA said that on December 1, it identified suspicious activity within its internal network. The pathology centre immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

ACLA also took steps to contain the incident, secured the affected systems and notified relevant law enforcement authorities about the same.

 

“Over the course of our investigation, we learned of information suggesting that an unknown actor may have gained access to our network and downloaded certain files without authorisation. Following a comprehensive review of the affected data, which concluded on April 27, 2026, ACLA learned that certain individuals’ personal and/or protected information may have been involved in this incident,” ACLA said.

 

The compromised data included names, dates of birth, Social Security numbers, taxpayer identification numbers, medical dates of service, medical provider names, mental or physical condition, medical treatment/procedure information, diagnosis or clinical information, medical history, patient account numbers, and medical record numbers.

 

“ACLA has taken steps to augment security and reduce the risk of similar incidents occurring in the future,” the pathology center said.

 

ACLA has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general. 

 

It has also offered complimentary identity protection and credit monitoring services through Epiq to all affected individuals.

 

In February, the Insomnia ransomware group claimed responsibility for the cyber attack on ACLA and listed it as a victim on its data leak site. However, neither the group nor the pathology centre revealed any details on whether a ransom was paid.

 

x

 

 

The Insomnia group, whose activities have not been reported in the past, announced the hacking of 17 healthcare organisations on the same day, of which 16 are registered in the United States.

 

The list of victims included Optimum Health Institute, Southern Illinois Dermatology, Advanced Healthcare Professionals, Internal Medicine of Milford and Flint Hills Dialysis.