Медицинская лаборатория Гемотест (Gemotest) Data Breach (2022): What Was Exposed & What To Do

In April 2022, a data breach at the Russian medical laboratory Медицинская лаборатория Гемотест (Gemotest) exposed records containing 6.3 million unique email addresses along with names, physical addresses, dates of birth, passport numbers and insurance details. The incident was reported on 22 April 2022 and later resulted in a fine for the company. The breach affected records linked to 6.3 million unique email addresses, though one account of the event referred to 31 million patients. Public information does not specify the method of access or the exact number of individuals whose data was taken.

What happened

On 22 April 2022, reports emerged that Gemotest had suffered a data breach. The available information states that the incident exposed records containing 6.3 million unique email addresses together with names, physical addresses, dates of birth, passport numbers and insurance numbers. The same reports noted that Gemotest was later fined for the breach. No further details on the timing of the intrusion, the method used or the total volume of records have been disclosed in the available facts.

How a breach like this happens

Incidents involving large medical or laboratory datasets commonly result from unauthorised access to internet-facing servers, compromised credentials or misconfigured storage systems that hold customer or patient records. Once access is obtained, copies of databases can be removed without immediate detection. The scale of records held by organisations that process test results and patient identifiers makes them attractive targets, yet the specific sequence of events in any single case remains unknown unless investigators publish findings.

About Медицинская лаборатория Гемотест (Gemotest)

Gemotest operates as a medical laboratory in Russia, providing diagnostic testing services to patients. Organisations of this type routinely collect and store personal identifiers, contact details, dates of birth, government-issued identity numbers and health-insurance information in order to process orders and deliver results. A breach at such a facility is consequential because the data are both sensitive and persistent: health-related records and identity documents do not change frequently and can retain value for longer periods than many other categories of personal information.

What was likely exposed

The facts list the following data types as exposed: dates of birth, email addresses, genders, government-issued IDs, health-insurance information, names, passport numbers and physical addresses. The reports specify that the data included 6.3 million unique email addresses. The precise contents of every record and the total number of individuals affected beyond the count of unique email addresses remain unconfirmed in the published information.

Why it matters

Exposure of passport numbers, insurance details and health-related identifiers can increase the risk of identity misuse or targeted fraud for the individuals concerned. For the organisation, the incident led to a regulatory fine and potential reputational consequences within its sector. Because medical laboratories hold data that patients cannot easily alter, the effects of such disclosures can persist for years even if the original breach is contained.

If your data was in this breach

Individuals who suspect their information may have been included should monitor their email accounts for unusual activity and consider changing passwords on any services that used the exposed address. It is also advisable to review statements from banks or insurers for signs of unauthorised use of passport or insurance numbers. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in public listings of this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.