Precipio data breach: files copied from a cloud storage account in November 2025

What happened at Precipio?

Precipio says it noticed suspicious activity on the account, contained it, reset the account's password and opened an investigation. Its review of the copied files was preliminarily completed on March 9, 2026. It then matched the data against its records and looked up contact details. Federal law enforcement was notified.

Date	What the letter and the regulators' records say
On or around November 23, 2025	Unauthorized access to the cloud storage account; files copied
January 23, 2026	Report to HHS (22,739)
March 9, 2026	Review of the files preliminarily completed
April 23, 2026	Letter date; logged in Massachusetts (227 residents)

Precipio reported to HHS two months after the access and before its file review was done. Letters went out five months after the access.

What information was involved?

The letter names the reader's name with other items that vary by person; the sample leaves those blank. For the 227 Massachusetts residents in Precipio's notice, the state's record marks Social Security numbers, medical records and driver's licenses as breached. The HHS record names a network server and "other" as the location of the data. The letter does not say which cloud service held the account.

What is Precipio offering?

Item	Detail from the letter
Service	Single-bureau credit monitoring, credit report and credit score, with alerts for twenty-four months from enrollment, plus proactive fraud assistance

The guide to credit monitoring offers sets Precipio's offer beside other letters.

What Precipio told investors about the breach

Precipio is listed on Nasdaq, so the breach also appears in its SEC reports. Those reports add a detail the letter leaves out: the account belonged to an employee. The annual report for 2025, filed March 30, 2026, describes it that way and says the review of the data was still under way. The same report lists the response steps. Law enforcement was told, outside cybersecurity specialists were hired and the account was secured.

By the quarterly report for April to June 2026, filed August 14, 2026, the wording had firmed up: access that may have happened became access that did. That report dates the first report of the incident to December 4, 2025, without saying to whom, and confirms that notices began in April 2026. It does not put a cost on the incident.

Filed	Filing	What it says
March 30, 2026	Form 10-K, fiscal 2025	An employee's cloud storage account; access possible, not yet confirmed; publicly disclosed in January 2026; review continuing
May 14, 2026	Form 10-Q, quarter ended March 31, 2026	Does not mention the incident
August 14, 2026	Form 10-Q, quarter ended June 30, 2026	Access confirmed; first reported December 4, 2025; review preliminarily completed in March 2026; notices from April 2026

Precipio did not file an Item 1.05 Form 8-K for the breach. Its 8-Ks since November 2025 cover quarterly results, investor material, a director or officer change and a shareholder vote, none under Item 1.05. The quarterly report for January to March 2026 does not mention the incident at all. The guide to Item 8.01 versus Item 1.05 explains how listed companies choose between those two forms for an incident.

Whose account was accessed in the Precipio breach?

An employee's cloud-based storage account, according to the company's SEC filings. The notice letter calls it only a Precipio cloud-based storage account and names neither the employee nor the cloud service.

Did Precipio report the breach to the SEC?

Only in its periodic reports. There is no Item 1.05 8-K, which is the form listed companies use for incidents they judge material. The breach first appears in the 10-K for 2025, and the second 10-Q of 2026 updates it.

What Texas's attorney general recorded

Texas's attorney general lists a report from Precipio, Inc., posted on April 24, 2026, with 4,952 Texans affected, a count of Texas residents only. The record lists Social Security numbers, driver's license numbers, government ID numbers, financial account or card information, medical information and health insurance information as involved.

What the documents leave open

• How the intruder got into the storage account.
• How many files were copied.

With 22,739 people, Precipio's report is the 115th largest of the 415 open 2026 reports in the ranking of 2026 healthcare breaches reported to HHS.