LabCorp investors file lawsuit, alleging 'persistent' failure to secure data

Burlington, North Carolina-based LabCorp never informed shareholders about the exposure of sensitive information this year, the lawsuit states.

LabCorp investors have filed a lawsuit against the company following a major data breach last year that was one of three cybersecurity incidents the company has faced since 2018.

The suit, filed by shareholder Raymond Eugenio on behalf of LabCorp investors, alleges that the medical testing company’s chief executive, chief financial officer, chief information officer and its board of directors failed to address “persistently deficient” data protection measures.

The legal complaint, first reported by Bloomberg, involves a hack on the American Medical Collection Agency (AMCA), a debt collection agency which made collections on behalf of LabCorp and other medical companies. Hackers stole data about roughly 20 million people, including some 7.7 LabCorp patients, between August 2018 and March 2019. In a separate incident, LabCorp exposed 10,000 medical documents, including patient test results, according to a TechCrunch article published in January.

Burlington, North Carolina-based LabCorp never informed shareholders about the exposure of sensitive information this year, the lawsuit states. Investors also claim that 10.2 million LabCorp patients were affected by the AMCA breach, a higher figure than the 7.7 million people initially thought to be affected. The company’s failure to improve its security after the initial breach contributed to the data exposure, the suit also alleged.

“In light of LabCorp’s history of information security challenges, the company has both the knowledge and responsibility to heighten information security standards and processes to better protect the patients it serves,” the suit states.

Attackers previously infected LabCorp with ransomware in a separate cyberattack in mid-2018, resulting in system outages which lasted for days.

This suit comes after shareholders in Zoom, the San Jose-based maker of video-conferencing software, accused executives of fraud in connections with the company’s data protection strategies. By failing to disclose security vulnerabilities, and minimizing the extent to which unauthorized outsiders could have accessed data, plaintiffs alleged, Zoom leadership cost investors money.

The LabCorp lawsuit follows a similar logic. The medical testing company is subjecting shareholders to “continuing harm because the adverse consequences of the actions are still in effect and ongoing,” the suit states.

Meanwhile, the lawsuit likely only adds to the list of concerns at LabCorp. The company reported a net loss of $317.2 million in the first quarter of 2020, citing higher costs and lower demand due to the coronavirus pandemic.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems