The confirmation, as carried by SC Media, which credits Tech Radar for further coverage, names no phishing lure, no exploited appliance and no malware family [10][11], and no actor has come forward, since nobody has claimed the theft [9].
Both ends of the intrusion are dated: activity around June 15, detection in mid-June [2]. Those overlap, which puts time-to-detect at days rather than months [1]. The gap in this record sits after that point. The submission date to the Department of Health and Human Services and the date Baylor Genetics wrote to the people named in the report are both missing from what has been published [12], so the interval between a mid-June detection and public knowledge cannot be measured from the available account.
The count is exact where the confirmation is round. The HHS report lists 2,810,878 individuals [5]; the statement says approximately 2.8 million [4]; the difference is 10,878 people [2]. The filed figure is the one with regulatory weight, and it is not split between patients and staff [14].
Baylor Genetics says operations continued as usual and that as of its report there was no confirmed identity theft, fraud or misuse of the stolen information [8]. That is a statement about what the lab can observe from inside.
The two victim populations lost different things. Patients lost names, dates of birth, medical testing information and laboratory test results, plus health insurance information and Social Security numbers for a limited subset [6]. Current and former employees lost Social Security numbers, government-issued identification numbers and financial account information [7]. For a clinical genetics laboratory, the patient itemization stops at test results, leaving open whether sequence or variant data was part of the stolen set [15]. Whether it was decides if this is a fraud exposure with a shelf life or one that never ages, and that is a question the available account leaves open.
