Almeida Law Group is investigating a data breach at Anatomic and Clinical Laboratory Associates, P.C. If you were affected, contact Almeida Law Group.
About Anatomic and Clinical Laboratory Associates, P.C.
Anatomic and Clinical Laboratory Associates, P.C. (ACLA) is a physician-owned pathology group based in Nashville, Tennessee, located at 2010 Church St. It provides diagnostic anatomic and clinical pathology services to Ascension St Thomas Hospitals, outpatient surgery centers, and physician offices across middle Tennessee. Its subspecialties include blood banking, hematopathology, cytopathology, gastrointestinal and hepatobiliary pathology, gynecologic and breast pathology, and general surgical pathology. Because ACLA is a healthcare provider handling diagnostic and clinical pathology work, the records it maintains include sensitive personal and medical information, making any unauthorized access to its systems a significant concern for patients.
What Happened?
ACLA was listed in a HHS Office for Civil Rights breach portal report submitted on June 23rd, 2026, describing a hacking/IT incident affecting a network server. No business associate was identified as involved.
According to ACLA’s own notification letter filed with the Massachusetts Attorney General on June 23rd, 2026, the organization became aware of potential unauthorized activity in its computer network on December 1st, 2025. ACLA launched an investigation with external cybersecurity experts and determined that an unknown actor may have gained access and downloaded certain files without authorization. A comprehensive review of the affected files concluded on April 27th, 2026, and notification letters were mailed to 169,626 affected individuals on June 23rd, 2026. The roughly seven-month gap between discovery and notification is notable. According to Cole & Van Note’s reproduction of ACLA’s breach notice, the information involved may include names, dates of birth, Social Security numbers, taxpayer identification numbers, medical dates of service, medical provider names, mental or physical condition, medical treatment and procedure information, diagnosis or clinical information, medical history, patient account numbers, and medical record numbers. ACLA is offering complimentary credit monitoring and identity theft protection services through Epiq to affected individuals.
Separately, the ransomware group known as “Insomnia” publicly claimed responsibility for an attack on ACLA on approximately February 7th, 2026, according to dark web monitoring sources including DeXpose and Breachsense. These are attacker-side allegations from a ransomware leak site and have not been confirmed by ACLA or regulators as being linked to ransomware. The HHS filing describes the incident only as a hacking/IT incident. Cole & Van Note, a California-based class action firm, publicly announced an investigation into potential class action claims related to this incident as of June 25th, 2026, and ClaimDepot is also soliciting affected individuals for potential lawsuit claims. No filed class action complaint has been identified as of the research date.
Key Facts at a Glance
- Company or Organization: Anatomic and Clinical Laboratory Associates, P.C.
- Industry: Healthcare – Clinical/Anatomic Pathology Laboratory Services
- Location: Nashville, Tennessee
- Incident type: Hacking/IT Incident (Network Server)
- Date breach discovered: December 1st, 2025
- Date of consumer notification: June 23rd, 2026
- Total persons affected: 169,626
- Identity theft protection offered: Yes – complimentary credit monitoring and identity theft protection through Epiq
- Litigation status: Law firm investigations announced (Cole & Van Note, ClaimDepot); no filed class action complaint identified as of research date
- Source: HHS Office for Civil Rights breach portal report (https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf#1467436); ACLA Notification Letter – Massachusetts AG Filing (https://www.mass.gov/doc/2026-1014-anatomic-and-clinical-laboratory-associates-pc/download); Cole & Van Note Investigation (https://colevannote.com/2026/06/25/anatomic-clinical-laboratory-associates-p-c-data-breach-investigation/); DeXpose – Insomnia Ransomware Claim (https://www.dexpose.io/insomnia-ransomware-strikes-anatomic-clinical-laboratory-associates/)
What Should You Do?
If you received a notice from ACLA, enroll in the complimentary credit monitoring and identity theft protection offered through Epiq before the enrollment deadline stated in your notice. Whether or not you enroll, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — to make it harder for anyone to open new accounts in your name. Review your credit reports for unfamiliar accounts or inquiries at AnnualCreditReport.com, and monitor your existing financial accounts for suspicious activity. Because health and medical information was involved in this breach, also review your Explanation of Benefits statements from your health insurer and request copies of your medical records to check for any treatment or billing you do not recognize. If you spot signs of identity theft or fraud, report them at IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
