Quest Diagnostics pins breach affecting 11.9 million patients on debt collector

The unauthorized access occurred between August 1, 2018 and March 30, according to an SEC filing.

Medical data and financial information of nearly 12 million people may have been compromised in a data breach at a billing firm that works with Quest Diagnostics, the laboratory company said in a regulatory document.

The exposed information included credit card numbers and bank account details, Quest said Monday in a U.S. Securities and Exchange Commission filing. The New Jersey-based corporation is one of the giants in the medical testing industry, with more than $7.5 billion in revenue in 2018.

Quest said the American Medical Collection Agency notified it on May 14 about a security incident. AMCA discovered that an outsider infiltrated its web payment system and accessed data belonging to other companies, including Quest Diagnostics.

Quest had outsourced its billing work to Optum360, a health care revenue-cycle manager, which contracted AMCA. AMCA describes itself as a provider of “professional debt collection services are providers that specialize in collecting delinquent accounts,” according to its website.

The unauthorized access occurred between Aug. 1, 2018 and March 30 and affected as many as 11.9 million patients, according to the SEC document. Social Security numbers were also involved, Quest said, but did not provide further details.

Quest said it has not yet received “detailed or complete” information about the breach from AMCA.

In response to the incident, Quest says its suspended sending requests to AMCA, begun notifying regulators and affected health plans, and that it is working with outside security consultants to investigate the matter.

Quest’s “in-network status now extends to approximately 90 percent of commercially insured lives in the U.S.,” CEO Steve Ruscowski said in a February earnings statement. It offers testing for major diseases and conducts drug screening for employers, among other services.

This breach follows a 2016 hack that exposed the test results and personal information of some 34,000 patients in Quest’s database. Laboratory test results that Quest provided to AMCA were not affected by the breach disclosed Monday, Quest said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure