Personalis Data Breach 2026: 650 Cancer Genomics Patients Exposed via Email Compromise. VA Million Veteran Program Provider. What To Do

What happened

Personalis, Inc. (NASDAQ: PSNL) is a publicly-traded cancer genomics company headquartered in Fremont, California. Core products include NeXT Personal (an ultrasensitive circulating tumor DNA / minimal residual disease test) and tumor / immune profiling. Personalis is the sole sequencing provider to the VA Million Veteran Program (MVP) — one of the largest genomic databases in the world.

Personalis filed with HHS OCR on February 4, 2026 — Hacking/IT Incident at Email — confirming 650 affected individuals. Specific incident timeline, threat actor, and PHI categories have not been publicly disclosed beyond plaintiff-firm characterizations.

The “Email” location code is consistent with business email compromise (BEC) — phishing or credential intrusion of one or more employee mailboxes. No ransomware group has claimed responsibility; no dark-web leak-site listing has been observed.

Why a small genomic breach carries outsized risk

Personalis’ email correspondence environment likely contains:

• Oncologist orders for genetic testing
• NeXT Personal test reports as PDF attachments
• Patient and clinician correspondence about results
• Tumor profiling reports

Raw FASTQ / VCF genomic sequence files almost certainly are NOT in scope — those live in segregated laboratory information systems, not email. But genomic test report PDFs attached to email are plausibly in scope, and those reports identify specific gene variants and cancer mutations.

Three risks make this breach uniquely severe even at 650 individuals:

1. Genomic information is immutable — unlike SSNs that can be reissued, genetic data cannot be changed.
2. Family implication — your genomic data partly describes your blood relatives. They have an implicit privacy interest but no consent role in your medical records.
3. VA / Million Veteran Program ambiguity — Personalis’ MVP relationship means the affected population could include veterans. This is not publicly confirmed — the small affected count (650) more likely reflects commercial-clinical email correspondents than the MVP cohort, but the question is open.

What was potentially exposed

Per plaintiff-firm aggregations (not entity-confirmed):

• Full name, addresses
• Date of birth, contact details
• Social Security number
• Government IDs
• Medical information
• Financial information
• Potentially medical or genetic data related to Personalis’ cancer genomics and sequencing services

If you receive a Personalis notification letter, the letter will list the specific data elements involved in your case.

What Personalis is offering

No publicly available specifics on credit monitoring vendor, duration, or call center vendor. Plaintiff-firm pages reference generic “credit monitoring or identity protection services that may be offered” but this is not a confirmed Personalis offering.

Read your specific notification letter for the offered remediation and activation details.

What to do

1. Read your specific notification letter to confirm what data elements were involved and what monitoring is offered.
2. Place free credit freezes at Equifax, Experian, TransUnion if SSN exposed.
3. If your NeXT Personal or tumor-profiling report was potentially exposed, document the breach in case the specific gene-variant data surfaces in future contexts (insurance underwriting, employment background checks).
4. Inform blood relatives — your genomic data partly describes their genetic risk. They may want to be aware that data linked to your medical history is potentially in circulation.
5. If you are a VA Million Veteran Program participant, contact the VA directly to ask whether your sequencing data is implicated.
6. Stop the ongoing flow of your genomic data. HealthConsent files HIPAA restriction requests covering molecular diagnostic and genomic sequencing pathways.

Continue reading

• Your eight HIPAA rights, in plain English
• California CMIA: stronger protections than federal HIPAA
• Other 2026 healthcare data breaches