Enzo Biochem said ransomware attack exposed test data on 2.47 million people

Enzo Biochem, a New York biotechnology and clinical diagnostics company based in Farmingdale, disclosed in a filing with the United States Securities and Exchange Commission that a ransomware attack had exposed clinical test information belonging to roughly 2.47 million people.

The company said the attack took place on April 6, 2023. On April 11 it determined that data including names, test information and Social Security numbers had been accessed and in some cases removed from its systems. It put the number of individuals whose clinical test information was involved at approximately 2,470,000, with Social Security numbers for around 600,000 of them. Enzo said it was still investigating whether employee information had also been taken.

Enzo, which produces DNA based tests used to detect viral and bacterial disease including COVID-19, disconnected systems from the internet in response and said its facilities continued to provide services to patients and partners throughout. Chief executive Hamid Erfanian said the company remained subject to risks and uncertainties as a result of the data that was accessed or exfiltrated from its network.

No ransomware group was publicly identified and Enzo did not say whether it had received a ransom demand or how the intruders got in. TechCrunch reported that company spokesperson Lynn Granito did not return its request for comment. Enzo said it had begun assessing the financial impact, would notify affected individuals by mail and would report the incident to the relevant regulators.