Annapath Pathology Services was identified on October 22, 2026, in reports stemming from dark web monitoring and a ransomware leak site listing. The Maryland-based surgical and cytopathology laboratory was alleged by threat actors to have suffered a security incident. In response to the claims, consumer law firms initiated preliminary investigations into the matter.
As of late October 2026, the company has not publicly confirmed the breach, and no regulatory filings have appeared with state attorneys general or federal authorities. The specific types of data, number of potentially affected individuals, and systems involved remain unverified. It is not known whether patient medical records or employee personal data were accessed.
Details surrounding unverified ransomware claims often emerge as investigations progress. Formal breach notifications to regulators and consumers may follow if an internal forensic investigation confirms unauthorized data access.