The aftermath of the data breach that has exposed financial data of about 20 million American and launched at least 19 class actions against AMCA and its partner laboratories was so severe that American Medical Collection Agency filed for bankruptcy.
The medical bill collection company has suffered and eight-month-long data breach since August 1, 2018, to March 30, 2019, leading to the theft of financial information including their names, phone numbers, dates of birth, home addresses, social security numbers, credit card numbers, and other bank details. Worse, the report reveals that the stolen information has been auctioned in underground forums and the black market.
The information belongs to Americans who paid laboratory services at several clinical and blood testing labs and institutions and used the AMCA billing portal. The laboratories and medical testing facilities involved in the breach are Quest Diagnostics (11.9 million patients), LabCorp (7.7 million patients), BioReference Laboratories (Opko Health subsidiary, 422,600 patients), Carecentrix (500,000 patients), and Sunrise Laboratories (undisclosed number of patients).
As a result, the involved companies, together with AMCA, is currently facing multiple lawsuits over the incident. More than 11 class-suite actions have been filed against the three companies for their inability to protect consumer data. The 11 lawsuits were recorded at The United States Judicial Panel on Multidistrict Litigation (JPML) on June 3. Since then, eight more lawsuits were filed against the companies in federal courts from New Jersey, New York, and California.
“Healthcare companies are especially susceptible to data breaches not only because they aggregate a tremendous amount of important and sensitive data, but also because they tend to be less focused on cybersecurity protection than other industries,” said John Yanchunis of Morgan and Morgan, one of the firms who filed lawsuits against Quest Diagnostics.
“These companies, like Quest Diagnostics, know they are at an increased risk and yet have not taken the proper steps to protect their patients’ data. We will fight for justice on behalf of those impacted by this breach,” he added.
The U.S. government, led by attorneys general from Connecticut and Illinois has also opened an investigation on the matter. Furthermore, lawmakers and other politicians have sent letters to the responding companies to ask for an explanation of why an eight-month data breach remained undetected and to demand accountability from them.
Filing for bankruptcy is AMCA’s next move
The effects of the data breach have created a “cascade of events,” leading to the bankruptcy request as the billing portal has been closed and is now under investigation.
“Almost immediately upon learning of the breach, LabCorp unqualifiedly and indefinitely terminated its relationship with the Debtor,” the filing reads. “Soon after, Quest Diagnostics, Conduent, Inc., and CareCentrix, Inc. which together with LabCorp were the Debtor’s four largest clients, stopped sending new work to the Debtor, and all terminated or substantially curtailed their business relationships with the Debtor.”
The filing added that the data breach “resulted in enormous expenses that were beyond the ability of the Debtor to bear.” According to experts, the estimated cost of the data breach to AMCA could reach up to $400,000 for cyber forensics alone. IT support costs, severe restrictions that were put in place to protect AMCA’s network from further intrusion, looming court cases, and the loss of valuable business partners have all taken their toll.
Furthermore, the billing company was also unable to determine exactly who are and what data was affected by the recent data breach, forcing them to pay out over $3.8 million to inform over seven million people who have potentially been impacted via mail. Data shows that this amount alone is more than that the company can take forcing them to take out a loan from the CEO and founder, Russell Fuchs.
AMCA laid off 78% of employees
Because of the bankruptcy request, it follows that not only are the executive level will suffer – employees are also being laid off as an effect of the petition. AMCA’s current employee count is down from 113 to 25, which practically cut of 78% of its human resources. Fuchs has asked the court to consider a motion which will ensure the firm’s remaining staff will be paid during the process.
“Accordingly, the Debtor has filed the instant Chapter 11 petition in order to allow it the breathing room to evaluate its pool of remaining assets and liabilities appropriately, cost-effectively respond to regulatory demands, and ultimately, to wind-up of its business in an orderly fashion through a liquidating Chapter 11 plan,” the filing concludes.