Ransomware Group Genesis Claims Attack on US Laboratory Firm A&B Lab
The group listed the laboratory services company on its dark-web site on 27 October 2026. A&B Lab has not confirmed any incident, and the claim has not been independently verified.
Key points
- Ransomware group Genesis listed US laboratory firm A&B Lab on its dark-web leak site on 27 October 2026, according to monitoring service Ransomware.live.
- A&B Lab has not publicly confirmed any breach, and the claim could not be independently verified at publication time.
- Genesis is an active ransomware-as-a-service operation; Threat Vectr has published 47 ransomware stories in the past 30 days alone.
- No ransom figure appeared in the group's post.
- Leak-site listings are written by criminals to pressure companies into paying and are sometimes exaggerated or false.
Genesis is a ransomware-as-a-service operation, meaning it's a criminal business that develops file-locking malware and rents it to affiliated attackers who carry out individual intrusions and share the proceeds. The group runs a dark-web leak site, a password-protected page on a hidden part of the internet where it names companies it claims to have attacked, typically to pressure them into paying a ransom before stolen data is published.
On 27 October 2026, Genesis listed A&B Lab, a US-based company that provides laboratory services, according to monitoring service Ransomware.live, which observed the post a day later. The group's listing describes the company as a provider of laboratory services. No ransom figure appeared in the post.
How serious is Genesis as a group?
Serious enough to watch. The pattern matters for A&B Lab because laboratory firms sit close to healthcare. They handle test results and clinical records, which makes them attractive targets for groups that know sensitive data commands higher ransom pressure. Threat Vectr covered a similar dark-web listing against US pharmaceutical company KC Pharmaceuticals on 9 October 2026, part of a run of unverified claims against health-adjacent businesses that hasn't let up.
Those figures cover unverified criminal claims, not confirmed breaches, but the volume signals an active operation.
Should A&B Lab customers or staff do anything right now?
Practical steps make sense even before any confirmation arrives. When a company's name circulates in ransomware news, criminals who have nothing to do with the original group sometimes launch follow-on scams that exploit the publicity.
Watch for phishing attempts, which are fake emails or text messages designed to look official and trick you into handing over passwords or personal details. If you receive a message claiming to be from A&B Lab asking you to log in or verify your information, treat it with suspicion and contact the company through a phone number you find independently, not one in the message itself. Ignore any call or email offering "breach compensation" in exchange for personal or banking details; that's a scam. If you reuse the same password across multiple accounts, change it now on any site where it appears. A password manager, a secure app that stores and generates unique passwords for each site, makes that easier to sustain.
A&B Lab has made no public statement about the listing. Whether this is a genuine intrusion or a false claim, the company itself hasn't said. That silence is normal at this stage; it's also exactly when scammers move fastest.
