Laboratory Services Cooperative (LSC), a Seattle-based non-profit organization providing lab testing services to select Planned Parenthood centers, has disclosed a major data security incident affecting approximately 1.6 million individuals.
The breach, discovered in October 2024, resulted in unauthorized access to sensitive personal and health information, marking one of the significant healthcare data exposures of the fiscal year 2025.
On October 27, 2024, LSC detected suspicious activity within its network infrastructure, triggering the immediate implementation of incident response protocols (IRP-HC2024).
Third-party cybersecurity specialists were engaged to conduct a forensic investigation while federal law enforcement was simultaneously notified per HIPAA breach notification requirements (45 CFR § 164.408).
LSC Network Breach: Protected Data Exfiltrated
“The investigation confirmed that an unauthorized third party had successfully penetrated our network security perimeter and exfiltrated certain files containing protected information,” said a spokesperson for LSC in their official statement.
“We’ve implemented comprehensive post-breach protocols to mitigate further risks.”
The scope of compromised data includes sensitive personally identifiable information (PII) such as names, addresses, phone numbers, Social Security numbers (SSN), driver’s license numbers, passport information, and dates of birth.
More concerning is the exposure of protected health information (PHI) under HIPAA regulations, including medical diagnoses (ICD-10 codes), treatment details (CPT codes), lab results, and treatment locations.
Additionally, certain financial data was compromised, potentially exposing payment card information (PCI), banking details, including routing numbers, and health insurance identifiers such as member/group ID credentials.
The security incident specifically impacts patients who received services at Planned Parenthood centers partnered with LSC for laboratory testing.
Not all Planned Parenthood facilities utilize LSC services, limiting exposure to specific geographic regions where partnership agreements exist.
Steps Taken by LSC
In February 2025, LSC received preliminary data analysis confirming the breach’s extent. The organization has implemented a multi-faceted remediation strategy including dark web monitoring (DWM) utilizing specialized threat intelligence services.
“Current scanning operations across TOR networks and underground forums have not detected the appearance of the compromised data sets,” noted the cybersecurity team engaged by LSC.
Affected individuals are being offered complimentary credit monitoring and medical identity protection through CyEx Medical Shield Complete for 12-24 months, depending on state residency requirements (pursuant to state data breach notification laws, including CCPA and CMIA regulations).
Security experts recommend immediate protective measures, including credit freezes with all three major credit bureaus (TransUnion, Experian, Equifax), establishing fraud alerts, and monitoring EOB statements for unexpected medical claims that could indicate medical identity theft.
The enrollment deadline for protection services is July 14, 2025. Complete incident details and FAQ resources are available at LSCIncidentSupport.com, which LSC recommends that affected individuals check periodically for updates regarding this incident.
This breach follows a troubling pattern of healthcare sector targeting, reminiscent of the 2021 Planned Parenthood Los Angeles ransomware attack that exposed approximately 400,000 patient records and resulted in subsequent class-action litigation.
Equip your team with real-time threat analysis With ANY.RUN’s interactive cloud sandbox -> Try 14-day Free Trial
