What Happened in the Decatur Diagnostic Laboratory Data Breach?
Decatur Diagnostic Laboratory Inc., a privately owned clinical laboratory based in Decatur, Alabama, has confirmed a data breach affecting patient information. The Decatur Diagnostic Laboratory data breach involves the theft of sensitive personal and health-related records from the lab’s computer systems. This disclosure has raised serious concerns among patients who relied on the lab for testing services.
On April 14, 2026, the ransomware group known as LockBit 5.0 publicly claimed responsibility for the cyberattack. According to the company’s notice, the attack resulted in unauthorized removal of data from its systems. This means the attackers did not simply access the network; they actually took copies of files containing patient information.
Following the discovery, Decatur Diagnostic Laboratory launched an investigation to determine the scope of the incident. As a result of that review, the company identified which individuals had personal and health information involved. The lab then reported the breach to the U.S. Department of Health and Human Services on June 16, 2026, and posted a formal notice of the data privacy event on its website.
Because ransomware groups like LockBit 5.0 often publish stolen files to pressure victims into paying, the public claim of responsibility serves as further confirmation that data left the lab’s systems. However, the source does not specify whether a ransom was paid or whether stolen files were posted publicly.
Who was affected?
The breach affects patients whose information was stored in Decatur Diagnostic Laboratory’s systems. Based on available information, at least approximately 500 individuals in the United States have been affected so far. This number could change as the investigation continues.
Because Decatur Diagnostic Laboratory operates as a clinical testing facility, most of the affected individuals are likely patients who submitted samples for lab work. In addition, the exposed information varied from person to person, meaning not everyone had the same categories of data compromised. The company has not disclosed whether any employees were also affected, nor has it specified the ages of those impacted.
What Information Was Potentially Exposed?
According to the notice, the stolen data included a range of personally identifiable information and protected health information. This combination of data types makes the breach particularly concerning for those affected. The exact information exposed depends on the individual.
- Full names
- Dates of birth
- Driver’s license numbers
- Social Security numbers
- Patient codes
- Medical record numbers
This type of data, when combined, creates significant risk for identity theft. For example, a criminal armed with a Social Security number, date of birth, and driver’s license number can often open new credit accounts or file fraudulent tax returns in a victim’s name. Because this data rarely changes, the risk does not disappear after a few months; it can linger for years.
In addition to identity theft, the exposure of medical record numbers and patient codes raises the possibility of medical identity theft. This occurs when someone uses stolen health information to obtain medical services, prescriptions, or insurance reimbursements under another person’s identity. As a result, victims may find inaccurate information in their own medical records, which can complicate future treatment.
What is the company doing?
In response to the breach, Decatur Diagnostic Laboratory notified the Department of Health and Human Services and posted a public notice describing the incident. The company also set up a phone line and mailing address so affected individuals can ask questions directly. This gives patients a way to seek clarification about their specific exposure.
However, the company’s notification did not include an offer of free credit monitoring or identity theft protection services. Instead, Decatur Diagnostic Laboratory provided guidance encouraging individuals to monitor their accounts on their own. Specifically, the company recommends reviewing account statements, explanation of benefits documents, and credit reports for suspicious activity over the next 12 to 24 months.
Because no free protective services were offered, affected individuals will need to take a more active role in monitoring their own information. This makes it especially important for patients to understand exactly what steps they can take, which are outlined below.
What Should Affected Individuals Do?
Monitor Your Credit Reports Regularly
Affected individuals should request copies of their credit reports and review them closely for unfamiliar accounts or inquiries. You can obtain free credit reports from each of the three major credit bureaus. Checking these reports on a rotating basis throughout the year allows for ongoing monitoring at no cost.
Because Social Security numbers were involved, this step is especially important. Fraudulent accounts opened with a stolen Social Security number often show up first on a credit report before a victim notices any other warning signs. Therefore, reviewing these reports regularly for the next year or two, as the company recommends, gives you a better chance of catching fraud early.
Consider a Credit Freeze or Fraud Alert
Given that Social Security numbers and driver’s license numbers were exposed, affected individuals should strongly consider placing a credit freeze with each credit bureau. A credit freeze blocks new creditors from accessing your credit file, which makes it much harder for identity thieves to open accounts in your name. This step is free and can be lifted temporarily whenever you need to apply for credit yourself.
Alternatively, a fraud alert requires potential creditors to take extra steps to verify your identity before granting credit. This option is less restrictive than a freeze but still provides meaningful protection. Because the stolen data included the exact combination of information needed to commit fraud, either option is worth pursuing right away.
Watch for Medical Identity Theft
Because medical record numbers and patient codes were part of the exposed data, affected individuals should carefully review any explanation of benefits statements they receive. These documents show what services were billed to your insurance. If you notice services you did not receive, this could indicate medical identity theft.
In addition, it may help to request a copy of your medical records periodically to check for inaccuracies. If you find suspicious entries, contact your healthcare provider and insurance company immediately. Reporting discrepancies early can prevent long-term complications with your medical history and insurance coverage.
Stay Alert for Phishing Attempts
Following any data breach, scammers often use stolen information to craft convincing phishing emails, texts, or phone calls. Because names, dates of birth, and other personal details were exposed, affected individuals should be cautious of unexpected messages claiming to be from Decatur Diagnostic Laboratory, insurance companies, or government agencies. Never click on links or provide personal information in response to unsolicited contact.
Instead, if you receive a suspicious message, contact the organization directly using a phone number or website you know is legitimate. This simple habit can prevent scammers from tricking you into revealing additional information. Given how detailed the stolen data was, staying alert to these tactics is a critical layer of protection.
Consult a Data Breach Attorney
Because Social Security numbers, driver’s license numbers, and medical information were all exposed, affected individuals may want to speak with an attorney who handles data breach cases. An attorney can help you understand whether you qualify for compensation and what options may be available to you. Many offer free consultations to review the specifics of your situation.
In addition, an attorney can help you track deadlines and evaluate whether joining or filing a claim makes sense for your circumstances. Since laws and filing windows vary, getting professional guidance early can help protect your legal options as the situation develops.
More Information
Official Data Breach Notification Letter (PDF)