More than 20 million and not 200,000 have fallen victim to a massive data breach that has seen medical clients using the services of healthcare billing company, American Medical Collection Agency (AMCA), to pay for their laboratory tests in different blood testing labs across the U.S. were confirmed by the SEC filings of affected medical institutions amidst the earlier claims of AMCA that there were fewer victims.
The data breach was a result of a cyber attack that aims to phish for financial information from the website of the AMCA. The exposed data belongs to Americans who paid laboratory services at several clinical and blood testing labs and institutions and used the AMCA billing portal.
What happened in the AMCA breach?
Data that were stolen from the victims include their names, phone numbers, dates of birth, home addresses, social security numbers, credit card numbers, and other bank details. The said information was auctioned off by the hacker in several financial hacking forums.
According to DataBreaches.net, the organization who first reported about the incident, AMCA officials, following the notification of the breach confirmed that their system has been compromised and has remained undetected for more than eight months. AMCA corroborated that the breach took place between August 1, 2018, and March 30, 2019.
Notifications have been sent by several of AMCA’s corporate partners and clients to their customers following the disclosure of the security breach that has seen information from millions of Americans compromised.
The list of impacted testing laboratories includes Quest Diagnostics (11.9 million patients), LabCorp (7.7 million patients), BioReference Laboratories (Opko Health subsidiary, 422,600 patients), Carecentrix (500,000 patients), and Sunrise Laboratories (undisclosed number of patients).
However, neither the AMCA nor its five clients have yet to notify ALL impacted citizens by the breach making them vulnerable to a lot of cyber crimes and their financial data could be used by anyone who gets hold of the information against the persons of those who still don’t know that their financial information is floating around the internet.
The companies involved in the breach are facing several lawsuits
Appropriately, the lawsuit came into the direction of AMCA, Quest, and LabCorp regarding the incident. More than 11 class-suite actions have been filed against the three companies for their inability to protect consumer data. The 11 lawsuits were recorded at The United States Judicial Panel on Multidistrict Litigation (JPML) on June 3. Since then, eight more lawsuits were filed against the companies in federal courts from New Jersey, New York, and California.
According to litigation experts, “If many cases are filed in federal court, any of the lawyers on any of those cases can file a motion with the JPML [..] to centralize the various federal cases that have been filed by sending all of them to a single judge for coordinated pre-trial proceedings.”
“Healthcare companies are especially susceptible to data breaches not only because they aggregate a tremendous amount of important and sensitive data, but also because they tend to be less focused on cybersecurity protection than other industries,” said John Yanchunis of Morgan and Morgan, one of the firms who filed lawsuits against Quest Diagnostics.
“These companies, like Quest Diagnostics, know they are at an increased risk and yet have not taken the proper steps to protect their patients’ data. We will fight for justice on behalf of those impacted by this breach,” added Yanchunis.
Lawmakers are demanding an explanation
The U.S. government, led by attorneys general from Connecticut and Illinois has also opened an investigation on the matter. Furthermore, lawmakers and other politicians have sent letters to the responding companies to ask for an explanation of why an eight-month data breach remained undetected and to demand accountability from them.
In Washington, US Sen. Mark Warner (D-VA) also sent a letter to Quest Laboratories demanding the company explain its vetting process for selecting AMCA as a billing vendor, and what requirements a third-party vendor has to pass. Democratic New Jersey Sens. Cory Booker and Bob Menendez also sent letters to AMCA, Quest, and LabCorp, seeking official answers on how a breach of this severity went undetected for eight months.
“The months-long leak leaves sensitive personal and financial information vulnerable in the hands of criminal enterprises. Moreover, such breaches force victims to contend with identity theft that may lead to irreparable harm to their credit reports and financial future,” said the letter sent by the NJ senators.