ACLA Discloses Data Breach Affecting Thousands, Exposing Sensitive Personal and Health Information Anatomic and Clinical Laboratory Associates P.C. (ACLA), a Nashville-based physician-owned pathology group, recently disclosed a data breach involving unauthorized access to its computer network. The incident, reported to the Massachusetts Office of Consumer Affairs and Business Regulation on June 23, 2026, affected 69 Massachusetts residents, though the full scope of impacted individuals remains unclear. ACLA first detected potential unauthorized activity on December 1, 2025, prompting an investigation that revealed an unknown actor had accessed and downloaded files without authorization. A comprehensive review of the affected data concluded on April 27, 2026, nearly five months after discovery. The breach exposed personally identifiable information (PII) including names, dates of birth, Social Security numbers, and taxpayer identification numbers as well as protected health information (PHI), such as medical histories, diagnoses, treatment details, and patient account numbers. In response, ACLA began mailing notification letters to affected individuals on June 23, 2026, providing details of the incident and offering complimentary credit monitoring and identity theft protection services through Epiq. The services include credit monitoring, dark web surveillance, identity restoration, and lost wallet assistance, with enrollment available until September 30, 2026. Affected individuals can activate the services using a personalized code from their notification letter. ACLA has also established a dedicated call center (866-659-7137) for incident-related inquiries, available for 90 days from the date of each individual’s notification letter. Those who did not receive a letter but suspect they may have been affected can verify eligibility by contacting 866-675-2006. The breach underscores the ongoing risks to sensitive healthcare data and the delayed timelines often involved in breach investigations and disclosures.