Myriad Genetics cyber incident: testing and order systems paused after unauthorized access, November 2026

Date	Event
November 2, 2026	Myriad detects unauthorized access; testing and order systems suspended
November 5, 2026	Form 8-K, Item 8.01, filed with the SEC; most systems back to normal
November 6, 2026	Form 10-Q for the third quarter filed
November 14, 2026	No Myriad notice yet on the California attorney general's list

What happened in the Myriad Genetics cyber incident?

The 8-K gives the steps Myriad took on discovery. It started its incident response procedures to contain the activity, assess and investigate its nature and scope, and put remedial measures in place. It hired outside experts for the investigation. The filing does not say how the intruder got in, whether ransomware was involved, or which systems were reached. It does not mention law enforcement.

Was Myriad's genetic testing disrupted?

Yes, for a time. Myriad says it paused its testing operations and its order management systems as part of the response. By November 5, when it filed, most of its systems were back to normal. The filing does not say how long testing was paused, or whether test results were delayed. Its quarterly report lists the tests by category: Cancer Care Continuum (MyRisk, BRACAnalysis CDx, MyChoice CDx, Prolaris + AI, Precise Tumor and Precise MRD), Prenatal Health (Foresight, Prequel, FirstGene and SneakPeek) and Mental Health (GeneSight).

Was patient data taken in the Myriad breach?

Myriad has not said so. On November 5 it was still working out whether any patient records on systems holding patient information had been accessed. Investing.com's report of the filing gives the same status. When this page was checked on November 14, 2026, the California attorney general's list carried no Myriad Genetics notice. If the review finds that protected health information was involved, the HIPAA rule requires notice to each affected person without unreasonable delay and no later than 60 calendar days after the breach is discovered. The HIPAA Breach Notification Rule entry explains when that clock starts. This entry will add a count when a regulator records one.

Why did Myriad file under Item 8.01 and not Item 1.05?

Item 1.05 is for a cybersecurity incident a company has judged material. Myriad filed under Item 8.01, other events, and said it did not believe the incident would have a material adverse effect on its business. The guide to Item 8.01 versus Item 1.05 shows how companies have moved between the two as they learned more, and operational shutdowns in 8-K filings compares how long other companies' systems stayed down.

What does Myriad's quarterly report say about the incident?

Very little. Myriad filed its 10-Q for the quarter to September 30, 2026 on November 6, four days after detection. Its subsequent-events note covers the October 19, 2026 agreement to sell assets of the Prenatal Health business to Laboratory Corporation of America for $210 million in cash plus inventory. On cybersecurity, the report's forward-looking statements name only the general risk of security breaches, loss of data and disruptions from cyberattacks. The November 2 incident is not described there.

Is the Myriad incident linked to the Quest Diagnostics breach?

Neither company has said so. They are two laboratory companies that filed Item 8.01 reports two weeks apart. Quest learned of unauthorized access to its Quanum LSM ordering and results system on October 21, 2026 (the Quest Diagnostics entry), and Myriad detected access to its network on November 2. Quest says patient records were accessed. Myriad is still checking whether any were. Health data in 8-K cyber filings compares how other health companies have described this kind of event.