Exact Sciences Data Breach: Is There a Settlement? (August 2026 Status)
Exact Sciences — the Madison, Wisconsin cancer-diagnostics company behind the Cologuard at-home colon cancer test and the Oncotype DX tumor-profiling tests, acquired by Abbott Laboratories earlier in 2026 — was hit by hackers this summer. You may also see this reported as the 'Abbott cancer diagnostics breach'; it's the same incident. Abbott has confirmed the intrusion and that impacted files contain personal and/or health information. The hackers claim 30 million rows of data and about one million Social Security numbers — claims that remain unconfirmed. Here's the honest status: a first class action is filed, law firms are recruiting — but no settlement exists, no claim form exists, and no notification letters have gone out yet.
Last reviewed: April 2026
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened — and What the Lawsuits Allege
In mid-June 2026, the hacking group ShinyHunters ran a vishing (voice-phishing) attack on Abbott employees and, per security reporting, compromised a Microsoft Entra single-sign-on account with access to internal systems. According to Abbott's regulator filing in Oregon, the intrusion was discovered on July 8, 2026. On July 15, ShinyHunters posted Exact Sciences on its dark-web extortion site, claiming 30 million rows of personal data, including roughly one million Social Security numbers — figures claimed by the attackers, not confirmed by Abbott or any independent forensic review. Abbott confirmed unauthorized access to 'a limited number of internal systems' in its Cancer Diagnostics business only, and on August 5 confirmed that some impacted files contain personal information and/or personal health information. The stolen data was later released publicly; breach-notification service Have I Been Pwned catalogued 10.9 million unique email addresses in the leak, alongside names, dates of birth, physical addresses, phone numbers, and health data of customers, patients, and healthcare providers. The lawsuits allege Abbott and Exact Sciences failed to implement necessary data-security safeguards to protect patients' sensitive medical information. (A separate July claim by a group called ShadowByt3$ about Abbott's LabCentral portal involved, per Abbott, only non-sensitive technical documentation — no patient data.)
Case Details
As of August 14, 2026, at least one proposed class action is on file: Troesch v. Abbott Laboratories and Exact Sciences Corp., filed in Illinois federal court in August 2026 by an Exact Sciences patient on behalf of all affected patients. There is NO settlement administrator and NO official claims site for this incident — none exists. Law firms including Ahdoot & Wolfson, Migliaccio & Rathod, Barnow and Associates, Levi & Korsinsky, and Schubert Jonckheer & Kolbe have opened investigations and are screening affected patients.
Current Status
Who Is Affected?
There is no official count of affected people yet — Abbott says it is still determining the full scope before making required notifications. For orientation: the publicly leaked data contained 10.9 million unique email addresses (per Have I Been Pwned) belonging to customers, patients, and healthcare providers, with names, dates of birth, addresses, phone numbers, and health data. The attackers' claim of ~1 million Social Security numbers is unconfirmed. If you (or a family member) ever used a Cologuard at-home colon cancer screening kit or had Oncotype DX tumor testing — or are a healthcare provider who ordered these tests — your information may be in the affected systems. Watch for a notification letter from Abbott or Exact Sciences; if one arrives, keep it — it documents that you're in the affected group.
Is There a Payout?
Timeline
- 1
Mid-June 2026 — Vishing Attack on Abbott Employees
Per security reporting, ShinyHunters targets Abbott employees with voice-phishing calls and compromises a Microsoft Entra single-sign-on account, gaining access to certain internal systems tied to the Exact Sciences cancer-diagnostics business.
- 2
July 8, 2026 — Intrusion Discovered
According to Abbott's data-breach filing with the Oregon attorney general, the unauthorized access is discovered on July 8, 2026. Abbott engages third-party cybersecurity experts and law enforcement.
- 3
July 15–16, 2026 — Extortion Post; Abbott Confirms Intrusion
ShinyHunters lists Exact Sciences on its dark-web extortion site, claiming 30 million rows of personal data including roughly one million Social Security numbers — attacker claims that remain unconfirmed. A day later, Abbott publicly confirms unauthorized access to a limited number of internal systems in its Cancer Diagnostics business only, describing the incident as a vishing attack, not ransomware. Operations and testing continue unaffected.
- 4
August 5, 2026 — Abbott: Files Contain Personal and Health Information
In an update, Abbott confirms that some of the impacted files contain personal information and/or personal health information, and says it is still analyzing the data to determine the full scope 'before making any required notifications.' No individual letters have been mailed at this point, and no credit monitoring has been offered.
- 5
August 2026 — Data Leaked Publicly; First Lawsuit Filed
The stolen data is released publicly; on August 7, Have I Been Pwned catalogues 10.9 million unique email addresses from the leak, with names, dates of birth, addresses, phone numbers, and health data. An Exact Sciences patient files the first proposed class action against Abbott and Exact Sciences in Illinois federal court, and at least five law firms open investigations.
- 6
Settlement — Not Yet
Before any settlement could exist, several things have to happen first: Abbott's forensic review confirming what was actually taken, individual notification letters, more filings and their consolidation, then motions and discovery. When a settlement fund, administrator, and claim form actually exist, this page will be updated with the official links and deadlines. Until then: there is nothing to file.
Scam & Misinformation Warnings
A breach involving cancer-test patients and (claimed) Social Security numbers is prime material for fraud — especially while official notifications haven't started. Watch for these:
Fake 'Exact Sciences settlement claim' sites
No claims portal exists — the first lawsuit was just filed and Abbott hasn't even finished determining who is affected. Any page, ad, or social post offering an Exact Sciences or Cologuard payout form today is a scam or clickbait. When a real settlement comes, the administrator's URL will appear in court filings — and on this page.
Impostor calls, texts, and emails about 'your cancer test results'
The leaked data reportedly includes contact details of people who took cancer screening tests — exactly what a scammer needs for a convincing call or email. Be suspicious of anyone contacting you about 'the breach,' 'your Cologuard results,' or 'protecting your Social Security number' and asking you to verify personal details, pay a fee, or click a link. Official word comes by mailed letter from Abbott or Exact Sciences, not an inbound call or text demanding information.
Fee-charging 'lawsuit sign-up' or 'breach protection' services
Nobody legitimate charges to 'add you' to a class action — if a class is ever certified, affected people are included automatically. Credit freezes at Equifax, Experian, and TransUnion are free by law; skip any paid 'breach protection' upsell.
Frequently Asked Questions
Is there an Exact Sciences data breach settlement?
No. As of August 14, 2026 there is no settlement, no claims administrator, and no fund. What exists: a confirmed intrusion into Exact Sciences' cancer-diagnostics systems, Abbott's confirmation that impacted files contain personal and/or health information, a publicly leaked dataset, a first proposed class action in Illinois federal court, and at least five law-firm investigations. If litigation proceeds, a settlement would be a 1–3 year path. Bookmark this page; we update it when anything changes.
Was my data actually stolen?
Partly confirmed, partly not. Confirmed: Abbott says some impacted files contain personal information and/or personal health information, and the stolen data was released publicly — Have I Been Pwned counted 10.9 million unique email addresses in the leak, with names, dates of birth, addresses, phone numbers, and health data. NOT confirmed: the attackers' claims of 30 million rows and ~1 million Social Security numbers. Whether YOUR record is included isn't knowable yet — no notification letters have been mailed as of August 14, 2026. You can check your email address at haveibeenpwned.com; a letter from Abbott or Exact Sciences is the official confirmation.
I used Cologuard (or had Oncotype DX testing) — am I affected?
Possibly. Exact Sciences processes Cologuard at-home colon cancer screening kits and Oncotype DX tumor-profiling tests, and the leaked data belongs to customers, patients, and healthcare providers of the Cancer Diagnostics business. That doesn't automatically mean every patient's record was taken — Abbott is still determining the scope. If you're affected, you should eventually receive a mailed notification letter; keep it as documentation. In the meantime, the protective steps below cost nothing.
How much money will I get?
Honestly: $0 today — there is no fund and no claim form. For a realistic reference point IF a settlement eventually happens: comparable healthcare data-breach settlements have paid documented out-of-pocket losses (often capped around $2,500–$10,000) plus small pro-rata cash payments (typically $50–$100), sometimes more where Social Security numbers or medical information were confirmed exposed. That is speculation until an actual settlement exists.
What should I do right now?
Four things cost nothing: (1) Freeze your credit at Equifax, Experian, and TransUnion — the strongest protection if your Social Security number was among the data. (2) Check your email address at haveibeenpwned.com — the leaked Exact Sciences data is searchable there. (3) Watch your medical insurance statements and explanation-of-benefits letters for tests or claims you don't recognize — medical identity theft is the specific risk here. (4) Treat any call, text, or email about 'the breach' or 'your test results' with suspicion — official word comes by mailed letter. If Abbott offers free credit monitoring later, enroll.
Do I need to sign up for the lawsuit?
No. If the class action is certified or settled, everyone fitting the class definition is included automatically. Law firms such as Ahdoot & Wolfson, Migliaccio & Rathod, Barnow and Associates, Levi & Korsinsky, and Schubert Jonckheer & Kolbe are screening affected patients — filling out their forms means volunteering as a potential client or named plaintiff, which is optional.
When will there be a settlement?
This case is at the very start of the cycle. The milestones to watch, in order: Abbott's forensic conclusion on exactly what was taken (settling the unconfirmed 30M-rows/1M-SSN question); individual notification letters, typically with a credit-monitoring offer; additional lawsuits and their consolidation before one court; then motions, discovery, and — in 1–3 years, if at all — a settlement. We update this page at each milestone.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Quantum Health Breach (count not disclosed)
Vishing attack on a health vendor — same early stage
TruStage Cyberattack (14 suits filed)
July 2026 attack — same no-settlement-yet stage
Conduent Breach (62.2M affected)
Consolidated litigation, no settlement yet
Data Breach Settlement Calculator
All breach trackers + payout estimator