LifeLabs Breach: 15 Million Customers and Health Data

Health records are different from a password. Once they leak, nobody can reissue them, and criminals know exactly how to use the details.

By Siddharth ShankarUpdated October 11, 2026

A lab test touches the most private parts of a life: a diagnosis, a pregnancy, a medication check. When a laboratory is breached, the data is not just an inconvenience. It is information a person cannot change, and that scammers can use to sound credible.

What happened

LifeLabs detected a cyberattack on its computer systems on October 28, 2019. The company announced the breach in December 2019. News coverage and the Alberta commissioner's report put the number of customers potentially affected at about 15 million, mostly in British Columbia and Ontario.

Privacy commissioners in British Columbia and Ontario investigated together and published joint findings on June 25, 2020. Alberta's commissioner published a separate report, P2021-IR-04, on October 13, 2021.

How it worked

The reports describe cybercriminals extracting data from LifeLabs systems. The commissioners found that LifeLabs had inadequate IT security policies and practices, and they said it failed to take reasonable steps to safeguard personal information and personal health information. They also found that the company collected more information than necessary in one instance.

Not every finding was negative. The commissioners concluded that LifeLabs took reasonable steps to contain and investigate the breach once it was detected. That is a useful distinction. Responding well afterwards does not cancel out the failure to protect the data beforehand.

What was exposed

The Alberta report lists the types of information involved: names, gender, phone numbers, addresses, email addresses, dates of birth, logins and passwords, Alberta Health Care numbers and lab results. Not every person had every field exposed.

Lab results are the sensitive core. Unlike a card number, a health history cannot be cancelled and replaced. A scammer who knows someone had a particular test can build a very believable call or message around it.

How it ended

The commissioners issued orders. LifeLabs was told to improve its IT security practices, formally adopt written policies, stop collecting specified information and securely dispose of records it had already collected, and improve how it tells people which health information was affected. The commissioners also recommended consulting independent experts on whether longer credit monitoring was warranted.

Alberta's report found LifeLabs failed to make reasonable security arrangements and did not keep information only as long as reasonably required. It made five recommendations and no orders. CTV reported that LifeLabs said it had invested $50 million in information security.

Key facts at a glance

• Detected: October 28, 2019
• People potentially affected: about 15 million, mostly in BC and Ontario
• Joint BC and Ontario findings: June 25, 2020
• Alberta report: October 13, 2021
• Data types (Alberta report): contact details, date of birth, logins and passwords, health card number, lab results
• Outcome: orders and recommendations; no fine in the documents we reviewed

What you can do

What the documents do not say

The sources we reviewed do not say whether a ransom was paid, and they give no count of affected Albertans. We have left both out. For a similar breach at a company that provides services to other organizations, see the Blackbaud case.

Why this case matters

The scale of the LifeLabs breach, about 15 million people, is large by any measure. It also shows how regulators in several provinces can work together on one investigation, and how findings can differ in detail between provinces.

For individuals, the lasting risk is that health details can be reused for years in convincing scams. Treat any unexpected message that mentions your health, your provider or your test results as unverified until you confirm it independently.

To turn the lesson into action, our guides explain what each type of breached data means, how to tell a real breach notice from a phishing message and what to do if your phone number was in a breach. You can also try our free email exposure check.