SSL and ACL and their current and former affiliates Data Breach — Official Case File

From the AG filing description

SSL and ACL and their current and former affiliates operate within the specialized and highly regulated landscape of medical, diagnostic, and clinical laboratory testing services. Organizations of this nature serve as critical links between patients, treating physicians, and health insurance networks by processing, analyzing, and storing extensive volumes of highly sensitive biological, clinical, and administrative records. Because of the core operational functions they perform, SSL and ACL maintain vast digital repositories containing detailed patient histories, diagnostic results, demographic data, and billing information. This high concentration of confidential information makes them prime targets for malicious actors seeking to exploit valuable health data on the dark web. In 2025, SSL and ACL and their current and former affiliates reported a significant data security incident to the Oregon Attorney General, raising serious concerns regarding the safety of the information entrusted to them. While details surrounding the exact technical vectors of the breach continue to emerge, incidents impacting clinical and diagnostic entities typically involve sophisticated cyberattacks such as unauthorized network intrusions, ransomware deployments, or compromises of third-party vendors integrated into the organization's digital infrastructure. These breaches often exploit vulnerabilities in legacy systems, inadequate network segmentation, or gaps in administrative monitoring, allowing unauthorized parties to bypass perimeter defenses and dwell undetected within internal systems for extended periods. The exposure resulting from the incident involving SSL and ACL and their current and former affiliates threatens individuals with severe and multifaceted risks. Depending on the scope of the breach, compromised records commonly include full names, dates of birth, Social Security numbers, health insurance details, medical record numbers, and clinical test results. The unauthorized disclosure of this specific combination of personal and protected health information creates an immediate danger of medical identity theft, where bad actors fraudulently bill insurers or obtain unauthorized treatments under a victim's name. Furthermore, when core identifiers like Social Security numbers and financial details are accessed, victims face long-term threats of traditional identity theft, fraudulent credit card applications, tax fraud, and unauthorized account takeovers. As a custodian of protected health and personal information, SSL and ACL and their current and former affiliates were legally bound by stringent regulatory frameworks, including the Health Insurance Portability and Accountability Act (HIPAA) and state data protection statutes, to maintain robust administrative, physical, and technical safeguards. These legal obligations mandate continuous risk assessments, encryption of sensitive data both at rest and in transit, strict access controls, and timely patching of known software vulnerabilities. The occurrence of a data breach of this magnitude serves as a strong indication that the organization may have failed to implement or maintain these required security measures, thereby breaching its legal duty of care and statutory compliance mandates. For individuals who received an official data breach notification letter from SSL and ACL and their current and former affiliates, this correspondence constitutes formal legal notice that their private information was compromised due to inadequate security practices. Legally, the receipt of this notice establishes standing to participate in class action litigation aimed at holding the company accountable for failing to safeguard sensitive data. Importantly, affected individuals do not need to demonstrate actual financial loss or out-of-pocket expenses to pursue legal remedies; the increased risk of future harm and the loss of privacy are sufficient grounds for action. Our law firm handles these complex data breach cases on a contingency fee basis, meaning affected class members pay absolutely nothing out of pocket, and there are no fees unless we successfully recover compensation on your behalf.