MARLBOROUGH, September 11 — A ransomware group calling itself MetaEncryptor claimed responsibility for a cyberattack on Hologic, Inc., the Massachusetts-based medical technology company known for its women’s health diagnostics and imaging systems, according to dark web monitoring sources. The claim was first observed on September 7 and alleged that the group had gained access to internal company systems. The allegation was reported by Ransomware.live, a dark web monitoring source.
As of this writing, Hologic has not issued a public confirmation of the incident, and the exact scope of any exposed data remains unknown. No breach date, discovery date, or confirmed data types have been reported.
No independent corroborating source has been found for this specific MetaEncryptor claim, and Hologic has not publicly issued any breach notification or confirmation tied to it.
A pattern of claims in 2026
This is not the first time Hologic has appeared in ransomware leak-site allegations this year. The group known as 0apt claimed Hologic as a victim on February 4, 2026, and the group Redact claimed Hologic on June 28, 2026, alleging exfiltration of 98 GB of data — though that figure is an attacker-side assertion only. None of these prior claims have been independently confirmed by Hologic.
It is unclear whether these represent separate intrusions, the same data being reclaimed under different group names, or false claims. Separately, a proposed class action lawsuit — Cameron v.
Hologic, Inc. — was filed in Massachusetts federal court alleging that sensitive personal data held by Hologic was exposed in a cyberattack, as reported by Law360 around July 2026. It is unclear which specific incident or claim the lawsuit relates to.
What is known about the group
MetaEncryptor is a ransomware group linked by researchers to the SFile ransomware family and suspected of later rebranding as the LostTrust ransomware operation. It uses a double-extortion model combining encryption with data exfiltration threats. Because the specific data types involved in this alleged incident have not been confirmed, it is not yet clear what personal information, if any, may have been exposed.
Attorneys at Almeida Law Group are investigating whether a class action lawsuit can be filed on behalf of individuals affected by a possible Hologic, Inc. data breach. As a precaution, individuals should place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor financial accounts and credit reports closely.
Free annual credit reports can be requested at AnnualCreditReport.com. If Hologic offers identity theft protection services, individuals should review the enrollment deadline carefully and consider taking advantage of any coverage offered. If information has been misused, IdentityTheft.gov provides step-by-step guidance.
If personal or health information was involved in this breach, individuals may have legal rights depending on the facts of the incident and the law in their state. Almeida Law Group represents consumers in data breach and privacy litigation and can be contacted at (708) 529-5418 or through their contact page for a free case evaluation.
About Hologic
Hologic, Inc. is a medical technology company headquartered in Marlborough, Massachusetts, founded in 1985. It develops, manufactures, and distributes diagnostic products, medical imaging systems, and surgical devices with a focus on women’s health. The company operates across four business segments — Diagnostics, Breast Health, GYN Surgical, and Skeletal Health — and serves clinical laboratories, hospitals, healthcare providers, surgeons, gynecologists, and radiologists.
Hologic employs approximately 7,000 people worldwide, operates in more than 15 countries, and reported approximately $4.1 billion in annual revenue as of 2025. The company is currently in the process of being acquired by Blackstone and TPG in a transaction valued at up to $17.9 billion.
For now, the key question is whether Hologic will confirm or deny the MetaEncryptor claim. Until then, the scope of any exposure — and what it might mean for patients and providers across the region — remains unverified.
