In July 2026, the extortion group leaked stolen data from Exact Sciences, the maker of Cologuard, after a failed ransom demand. The leak exposed names, emails, addresses, phone numbers, birth dates, genders, and personal health data for 10.9 million people. Affected individuals should monitor credit reports and watch for phishing referencing their health information.
| Company | Exact Sciences |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Full Names, Email Addresses, Physical Addresses, Phone Numbers, Dates of Birth, Gender Information, Personal Health Data |
| People Affected | 10.9 million unique email addresses |
| Attack Method | Extortion/Data Theft |
| Regulators Notified | Not Publicly Disclosed |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Exact Sciences Data Breach?
Exact Sciences, the maker of the Cologuard at-home colorectal cancer screening test, has confirmed a major data security incident. The company is now owned by Abbott Laboratories. Unauthorized access to its network occurred in July 2026, according to confirmed reporting on the incident.
The attack has been linked to a group, which reportedly ran a “pay or leak” extortion scheme against the company. Instead of relying on ransomware to lock down systems, this group claimed to have already pulled sensitive files from the cancer diagnostics side of the business. When a payment demand went unmet, the attackers followed through and published the stolen data publicly.
Because the material was posted online, researchers and security monitoring services were able to review its contents directly. This is how the scope of the incident became clear to the public. As a result, Abbott has acknowledged the exposure and started a formal review of exactly what the leaked files contain.
Abbott issued a public notice confirming that some of the impacted files hold personal information and personal health information. However, the company stated that more specific details would follow once its internal review wrapped up. This phased approach is common in large-scale breaches where the sheer volume of leaked data takes time to fully sort through.
Who was affected?
The breach potentially touches three separate groups: patients, customers, and healthcare providers connected to Exact Sciences’ cancer diagnostics operations. Because Cologuard is used broadly across the United States, the population affected likely spans many states rather than a single region.
The confirmed count tied to this incident is 10.9 million unique email addresses. This figure gives a strong indication of the scale, though the exact number of individuals whose full health records were included may differ from the email count.
Given that this involves a cancer screening product, some of the affected individuals may include people who underwent testing during a vulnerable or private health moment. In addition, healthcare provider information appears in the leaked data set, meaning medical professionals who ordered or processed these tests could also be impacted.
What Information Was Potentially Exposed?
The leaked files reportedly include a wide mix of personal and health-related details. This combination makes the exposure particularly sensitive, since health data paired with contact information creates a more complete profile for potential misuse.
- Full names
- Email addresses
- Physical addresses
- Phone numbers
- Dates of birth
- Gender information
- Personal health data
Because health records are included, the risk here extends beyond typical identity theft concerns. For example, exposed health data could reveal that someone underwent cancer screening, which many people consider deeply private. This kind of exposure can lead to targeted phishing attempts that reference real medical details to appear more convincing.
In addition, the combination of names, birth dates, and addresses gives criminals enough raw material to attempt identity theft, open fraudulent accounts, or file false insurance claims. Because email addresses were included at such a large scale, affected individuals should also expect an increase in spam and phishing attempts tied directly to this leak.
What is the company doing?
Abbott responded by publishing a public notice acknowledging the exposure once the leaked files came to light. The notice confirmed that personal information and personal health information appear within the compromised data. This immediate acknowledgment came before the company finished its full internal review.
Following this initial statement, Abbott indicated that additional specifics would be shared once its review of the incident concluded. This suggests the company is still working through the leaked files to determine precisely whose data appears and in what detail. As this review continues, affected individuals should watch for further official communication regarding notification and any protective services that may be offered.
Monitor Your Credit Reports
Anyone connected to Exact Sciences as a patient, customer, or provider should start checking their credit reports regularly. Because names, addresses, and birth dates were exposed, this data could be used to open new accounts in someone else’s name.
You can request free credit reports from the three major bureaus and review them for accounts you don’t recognize. If you spot anything suspicious, report it immediately to the bureau and consider filing a police report as well.
Consider a Fraud Alert or Credit Freeze
Because this breach included full names, dates of birth, and physical addresses, a fraud alert or credit freeze is a smart precaution. A fraud alert requires lenders to verify your identity before extending new credit, which adds a helpful barrier against impersonation.
A credit freeze goes further by blocking most new credit applications entirely until you lift it. This step is free and can be requested directly through each of the three credit bureaus. Given the personal details involved here, this extra layer of protection is worth the small inconvenience.
Protect Your Health Information
Since personal health data was part of this leak, affected individuals should watch closely for medical identity theft. This can include someone using your information to obtain prescriptions, treatment, or insurance benefits under your name.
Review your health insurance statements and explanation-of-benefits notices for any services you don’t recognize. If you spot unfamiliar charges, contact your insurer right away. Because health-related leaks can lead to particularly invasive scams, staying alert to unexpected medical bills or collection notices is especially important here.
Stay Alert for Phishing Attempts
Because millions of email addresses were exposed, phishing emails referencing Exact Sciences, Cologuard, or cancer screening results are a realistic threat. Scammers often use real breach details to make fraudulent messages look legitimate.
Never click links or download attachments from unexpected emails, even if they reference your actual test history or provider. Instead, contact Exact Sciences or your healthcare provider directly using a phone number or website you already trust. This simple habit can prevent most phishing attempts from succeeding.
Consult a Data Breach Attorney
Given the sensitivity of personal health information involved, affected individuals may want to explore their legal options. A data breach attorney can review the specifics of your exposure and explain whether you may be eligible for compensation.
Many attorneys offer a free case evaluation, so there’s little downside to asking questions. Because class action cases often have filing deadlines, it’s worth reaching out sooner rather than later if you believe your data was included in this leak.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.