Innovative Scientific Solutions (Luxor Scientific) Data Breach 2026: 143,842 Lab Patients Exposed. Broad PII + PHI Including SSN, Driver's License, Financial Data. What To Do

What happened

Innovative Scientific Solutions, LLC operates as Luxor Scientific, a clinical diagnostic laboratory headquartered at 1327 Miller Road in Greenville, South Carolina, with a second testing facility in Texas. The lab performs toxicology and drug screening, Epidermal Nerve Fiber Density testing, infectious disease panels, OWLIVER metabolomics, anatomical pathology, hemostasis, immunology, and women’s-health diagnostics. Its clients include hospitals, nursing facilities, clinics, individual medical practitioners, other laboratories, and universities.

On September 6, 2025, Innovative Scientific Solutions identified unauthorized third-party access to its network environment. Third-party cybersecurity professionals were engaged for forensic investigation. The forensic and document-review process was lengthy. On March 31, 2026, the company concluded that the affected files contained personally identifiable information and protected health information of patients whose samples had been processed through the lab.

Individual notification letters were mailed beginning April 7, 2026. The company filed with the US Department of Health and Human Services Office for Civil Rights on April 17, 2026 (143,842 individuals), filed with the Massachusetts Attorney General the same day (filing 2026-602, 192 Massachusetts residents), with the New Hampshire Attorney General on April 20 (3 NH residents), and with the Texas Attorney General on April 23 (2,823 Texas residents).

The roughly seven-month gap between detection and notification reflects the time required to manually review the affected documents and identify which patients were affected. The published state-AG resident counts (3,018 total) account for only about two percent of the OCR-filed national total, indicating that most affected individuals reside in states whose AG breach portals do not publish counts (Florida, Georgia, North Carolina, South Carolina, and similar).

No ransomware group has publicly claimed responsibility. No data tied to Innovative Scientific Solutions has been observed on dark-web leak sites.

What was stolen

The compromised data is unusually broad for a healthcare breach:

Identity and financial elements:

• Full name
• Date of birth
• Phone number
• Social Security number
• Driver’s license number
• Financial account information (this is rare; most healthcare breaches do not expose financial data)

Health-record elements:

• Health insurance policy and subscriber number
• Medical history and condition
• Treatment and diagnosis
• Dates of service
• Prescription information

The combination of SSN, driver’s license, AND financial account information creates a more complete identity-theft toolkit than a typical healthcare breach provides. The health-record elements add medical identity theft risk on top.

What Innovative Scientific Solutions is offering

Individuals whose Social Security numbers were exposed are being offered enrollment in Experian IdentityWorks Credit 3B (three-bureau credit monitoring), with ExtendCare identity restoration services and $1 million identity theft insurance. The notification letter does not specify the enrollment duration; Experian Credit 3B is typically offered for 12 or 24 months.

• Dedicated response line: 1-877-421-8788 (Monday to Friday, 9 a.m. to 9 p.m. Eastern)

What to do if you received a notification letter

This week:

1. Enroll in Experian IdentityWorks if your letter includes the activation code. The three-bureau monitoring is among the better packages offered in 2026 healthcare breaches.
2. Place a free credit freeze at Equifax, Experian, and TransUnion. Even with monitoring, the freeze prevents new accounts from being opened entirely.
3. File IRS Form 14039 to prevent fraudulent tax filings under your SSN.
4. Monitor your bank and credit-card statements closely. Because financial account information was exposed (rare in healthcare breaches), the risk of direct account fraud is higher than typical.
5. Review your Explanation of Benefits statements for unfamiliar lab orders, medical claims, or treatment encounters.

This month:

6. Stop the ongoing flow of your health data. HealthConsent files HIPAA restriction requests, FTC HBNR deletion requests, and state-law deletion requests so the prescription, diagnosis, and treatment data exposed in this breach is not continuously re-shared by downstream data brokers and ad-tech buyers.
7. Document any out-of-pocket losses. Four plaintiffs’ firms are publicly investigating. If a class action is filed and settles, recipients with documented losses may recover more.

Frequently asked questions

Why was financial account information in a lab’s records?

Patient billing data, payment methods on file for self-pay panels, and insurance-coordination data sometimes include financial account information beyond the standard health-record set. The fact that this dataset included it means Luxor’s billing-side systems were in the compromised environment, not just the clinical-results side.

Are my lab results in the breach?

The exposed data includes “treatment and diagnosis” and “dates of service” but the public notice does not specifically detail which test results were in scope. Given Luxor’s specialties (toxicology, drug screening, infectious disease, women’s health), some of the underlying results would be highly sensitive.

Should I sue?

Four plaintiffs’ firms are publicly investigating: Federman & Sherwood, Cole & Van Note, Murphy Law Firm, and Bryson Harris Suciu & DeMay. No class action complaint has been filed as of mid-May 2026. We are not a law firm and cannot give legal advice.

Is HealthConsent affiliated with Innovative Scientific Solutions or Luxor Scientific?

No. HealthConsent is an independent health-data privacy service.

Continue reading

• Your eight HIPAA rights, in plain English
• Other 2026 healthcare data breaches