Myriad Genetics Found Unauthorized Access on Its Network and Paused Testing While It Checks Whether Patient Records Were Reached
The Salt Lake City genetics company told the SEC it detected unauthorized access on its IT network on November 2, temporarily suspended testing and order-management systems, and reset some credentials. Whether any patient records were accessed is still under investigation. Most systems are back to normal.
When a diagnostic laboratory has to pause testing, the security incident stops being an IT ticket and becomes a patient-care problem. Myriad Genetics, the Salt Lake City genetics company, has told federal regulators that it found unauthorized access on its network and took those systems down while it tries to learn how far the intrusion went.
The account below follows the company’s current report on Form 8-K, filed with the U.S. Securities and Exchange Commission on November 5 and signed by Chief Financial Officer Benjamin R. Wheeler. The filing reports an event dated November 2 and lists the company as a Delaware corporation headquartered at 322 North 2200 West, Salt Lake City, Utah, with common stock trading on the Nasdaq Global Select Market under the symbol MYGN.
How the week unfolded
- November 2. Myriad detected unauthorized access within its information technology network environment.
- The same day, according to the filing. The company said that upon discovery it promptly started its incident-response procedures to contain the activity, assess and investigate the nature and scope of the incident, and put remedial measures in place. Those measures included temporarily suspending its testing operations and order-management systems and resetting certain system credentials.
- While the investigation continues. The full scope of the unauthorized access remains under investigation. That review, the company said, includes assessing whether any patient records were accessed on systems that contain patient information. External experts have been hired to help.
- November 5, the date of the report. Myriad said most of its systems have returned to normal operations. As of that date, it does not believe the incident will have a material adverse effect on its business. The disclosure appears under Item 8.01, “Other Events,” rather than as a notice the company itself labeled a material cybersecurity incident.
What the filing does not settle
The 8-K does not say who was behind the access, how they got in, how long they were inside, or whether any patient information was viewed or taken. Those points are explicitly still under review. The company also cautioned that its belief about the business impact is a forward-looking statement and could change as the assessment continues. Legal, regulatory, reputational and financial risks from this incident—or from additional incidents—are among the uncertainties it listed.
What this means for your company
Healthcare and other firms that handle sensitive records face two clocks at once: one for containing the intrusion, and one for telling patients, partners and regulators what is known. Myriad’s public notice is careful about what it can say so far—unauthorized access, testing and order systems taken down, some credentials reset, patient-record access still being checked, most systems back. That is a useful template for any owner who may one day have to explain an incident before the forensics are finished. Practice the first twelve hours: who can authorize taking a production system offline, how you reset credentials without locking out the response team, how you preserve logs, and who writes the first external statement so it does not claim more than you know. If you run lab, clinic or billing systems, also ask how long you could pause orders and still meet patient commitments.
Want a plain-language plan for containing unauthorized access and deciding what to tell patients or customers while an investigation is still open? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
