Patients and employees notified of the June 2026 Baylor Genetics data breach may be covered by a proposed class action alleging Baylor Genetics and Natera failed to protect lab results, health insurance details and Social Security numbers. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Baylor Genetics and Natera have not been found liable, there is no certified class, and nothing to claim at this time. This page is informational and is not legal advice.
What Is This About?
Baylor Genetics, a Houston clinical laboratory that runs genetic tests such as exome sequencing and prenatal screens, is facing a proposed class action over a cyberattack on its network in June 2026. The case, Frenkel v. Baylor Miraca Genetics Laboratories LLC d/b/a Baylor Genetics, No. 4:26-cv-08831, was filed October 8, 2026, in the U.S. District Court for the Southern District of Texas. It also names Natera, Inc., an Austin-based diagnostics company that the complaint says sends some patients’ tests to Baylor Genetics. The complaint claims the two companies did not use reasonable security to protect the patient and employee information they held. Neither company has responded in court, and nothing in the case has been proven.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Baylor Genetics Breach?
Baylor Genetics has given this account in its breach notice and on its website. On or around June 15, 2026, it spotted suspicious activity in part of its computer systems. A forensic investigation later found that an unauthorized party had been in portions of the network, and had reached data stored there, from June 11 through June 17, 2026. The company finished reviewing the affected files on or about July 30, 2026, and dated its notice letters August 14, 2026.The company says the information involved differs from person to person:
- Patients: names, along with one or more of date of birth, medical testing information, laboratory test results and, in some cases, health insurance information. Baylor Genetics says Social Security numbers were involved for a “very limited subset” of patients.
- Current and former employees: Social Security numbers, government-issued identification numbers and financial account information.
Baylor Genetics says it is not aware of any confirmed identity theft, fraud or misuse tied to the incident, that its laboratory kept operating, and that the accuracy of test results was not affected. It has not said who was behind the intrusion or how the attackers got in.
How Many People Were Affected?
Baylor Genetics reported the breach to the U.S. Department of Health and Human Services Office for Civil Rights as a hacking incident affecting 2,810,878 people, the figure the complaint relies on when it says “over 2.8 million” were affected. Earlier state filings counted residents one state at a time: 248,430 in Texas, 56,636 in Massachusetts and 2,630 in Vermont. The company’s notice adds that about 4,532 Rhode Island residents may be affected. Those state counts are pieces of the total, not competing estimates.What Does the Lawsuit Allege?
The plaintiff, a New York resident, says her doctor ordered Natera’s Vistara prenatal screen in 2025 and that Natera’s description of the test refers to Baylor Genetics. The complaint alleges, on information and belief, that Natera shares some of its patients’ information with Baylor Genetics so the lab can process or interpret certain genetic tests, which is why Natera is named alongside the lab. It does not claim Natera’s own systems were breached.According to the complaint:
- Both companies knew health and genetic data is a prime target for criminals and still failed to put reasonable safeguards in place, including measures the complaint ties to Federal Trade Commission guidance and HIPAA rules.
- The intruders were in the network for about a week, and Baylor Genetics did not detect them until four days after the access began.
- Notice letters went out roughly two months after the breach, which the plaintiff argues delayed people’s ability to protect themselves.
- Unlike a credit card number, medical and genetic information cannot be changed, so the plaintiff argues the risk of identity theft and medical identity theft lasts indefinitely.
The complaint quotes Baylor Genetics’ privacy notice, which says the company will let patients know promptly if a breach compromises their information, and Natera’s privacy notice, which says protecting health information is an important part of its business.
Who Is in the Proposed Class?
The complaint asks the court to certify two groups. In its words:- Class: “All persons whose personally identifiable information or personal health information was compromised in the Data Breach, including all persons who were sent a notice of the Data Breach.”
- New York Statutory Sub-Class: “All persons residing in New York state, whose personally identifiable information or personal health information was compromised in the Data Breach, including all persons who were sent a notice of the Data Breach.”
Baylor Genetics, Natera, their affiliates, officers and directors, and the judges and court staff on the case are excluded. These are proposed definitions only; the court decides later whether any class is certified.
What Claims and Relief Are Sought?
The complaint brings six counts. Five are on behalf of the nationwide class against both companies: negligence, negligence per se, breach of fiduciary duty, breach of implied contract and unjust enrichment. The sixth, for the New York subclass, claims violations of New York General Business Law § 349, the state’s law against deceptive business practices.The plaintiff asks for actual, statutory and punitive damages, restitution and disgorgement, and court orders requiring stronger data security and credit and medical identity monitoring for class members, plus interest, attorneys’ fees and a jury trial. The plaintiff is represented by Ajamie LLP and Abraham, Fruchter & Twersky, LLP.
What the Breach Notice Offers
The template notice letter Baylor Genetics filed with the California Attorney General says the company is offering complimentary credit monitoring and identity protection through IDX for either 12 or 24 months, with the length set out in each letter, and lists an enrollment deadline of November 14, 2026. Not every letter appears to include that offer: the copy attached to the complaint describes credit reports, fraud alerts and credit freezes but does not mention monitoring. The notice also describes the free annual credit reports available under federal law. Baylor Genetics’ security update page says the company has strengthened its monitoring, access controls and other safeguards since the incident.What Happens Next?
Baylor Genetics and Natera have not yet appeared in the case, and no judge is listed on the public docket. Data breach suits of this size usually draw additional complaints, and several law firms announced investigations of the Baylor Genetics breach in August 2026. When multiple suits are filed over the same incident they are often combined before a single judge, followed by a motion to dismiss and, much later, any class certification or settlement. OCA will update this page as the case develops.Questions
Who is covered by the Baylor Genetics data breach class action?
The complaint proposes a nationwide class of everyone whose personally identifiable information or personal health information was compromised in the breach, including everyone who was sent a breach notice, plus a subclass of New York residents. No class has been certified, and a court decides later whether one will be and what its limits are.
Is there a Baylor Genetics settlement or claim form?
No. The lawsuit was filed on October 8, 2026 and is at the complaint stage. There is no settlement, no certified class and no claim form. If the case ever settles, the court would approve a notice explaining any claim process.
Why is Natera named in the Baylor Genetics lawsuit?
The complaint alleges, on information and belief, that Natera shares some of its patients’ information with Baylor Genetics so the lab can process or interpret certain genetic tests. The plaintiff says her Natera prenatal screen was linked to Baylor Genetics. Natera has not been accused of suffering a breach of its own systems, and neither company has responded in court yet.
Does the Baylor Genetics breach include genetic test results?
According to Baylor Genetics, the patient data involved varied by person and could include names together with dates of birth, medical testing information, laboratory test results and health insurance information, with Social Security numbers involved for a limited subset of patients. Baylor Genetics says it is not aware of any confirmed identity theft or misuse and that the accuracy of test results was not affected.
How many people were affected by the Baylor Genetics data breach?
Baylor Genetics reported the breach to the U.S. Department of Health and Human Services as affecting 2,810,878 people. Its filings with state attorneys general list 248,430 Texas residents, 56,636 Massachusetts residents and 2,630 Vermont residents, and its notice lists about 4,532 Rhode Island residents.
Sources
• Frenkel v. Baylor Miraca Genetics Laboratories LLC, No. 4:26-cv-08831 (S.D. Tex.) — docket, complaint and notice exhibit• Baylor Genetics — Security Update on the June 2026 incident
• California Attorney General — Baylor Genetics template notice letter
• U.S. Department of Health and Human Services — Office for Civil Rights breach portal
• HIPAA Journal — report on the 2,810,878-person HHS filing
