AMCA Data Breach Impacts over 20 Million Quest Diagnostics and LabCorp Patients

In May, American Medical Collection Agency began notifying clients of a systems hack that began in August 2018 and lasted through March 2019. A hacker gained access to a server with a wide range of data from several AMCA clients including patient data and some Social Security numbers, among other sensitive information. LabCorp disclosed that about 200,000 people also had their credit card or bank account information stolen.

The breach was first disclosed by Quest Diagnostics, which reported in a Securities and Exchange Commission filing that a breach at third-party collections vendor American Medical Collection Agency (AMCA) compromised 11.9 million customers. Today, LabCorp indicated that 7.7 million of its patients were also affected by the AMCA breach.

The AMCA “remains committed to our system’s security, data privacy, and the protection of personal information,” the spokesperson said.

Quest said it is “taking the situation very seriously,” and is “committed to the privacy and security of our patients’ personal information.” The company also said laboratory results were not accessed by the unauthorized user.

LabCorp went on to say in the filing that AMCA said it was investigating the incident and has taken steps to enhance the security of its systems and data. AMCA plans on providing affected LabCorp consumers with more information about the incident, and identity protection and credit monitoring services for two years. LabCorp said it ceased sending new collection requests to AMCA and stopped AMCA from continuing to work on any pending collection requests involving LabCorp consumers.

Reference:

https://www.hipaajournal.com/amca-data-breach-impacts-12-million-quest-diagnostics-patients/

https://www.databreaches.net/american-medical-collection-agency-breach-impacted-200000-patients-gemini-advisory/

https://www.sec.gov/Archives/edgar/data/920148/000119312519165091/d757830d8k.htm