AMCA Breach Hits 12 Million Quest Diagnostics Patients

[David H. Lipman]

https://www.securityweek.com/amca-breach-hits-12-million-quest-diagnostics-patients

"A data breach at billing collections service provider American Medical Collection Agency (AMCA) could impact many of the company’s customers. One victim is medical testing firm Quest Diagnostics and roughly 12 million of its patients.

AMCA has yet make public any details about the breach, but in a filing with the U.S. Securities and Exchange Commission (SEC) Quest revealed that hackers had access to AMCA systems between August 1, 2018 and March 30, 2019.

AMCA provides services to Optum360, a revenue cycle management provider contracted by Quest. Optum360 and Quest were informed by AMCA about the security incident on May 14.

According to the available information, attackers compromised AMCA’s payment portal and they gained access to financial, medical and other personal information, including social security numbers, credit card numbers and bank account information. However, in a statement sent to SecurityWeek, Quest said laboratory test results were not exposed."

Quote

We are investigating a data incident involving an unauthorized user accessing the American Medical Collection Agency system. Upon receiving information from a security compliance firm that works with credit card companies of a possible security compromise, we conducted an internal review, and then took down our web payments page. We hired a third-party external forensics firm to investigate any potential security breach in our systems, migrated our web payments portal services to a third-party vendor, and retained additional experts to advise on, and implement, steps to increase our systems’ security. We have also advised law enforcement of this incident. We remain committed to our system’s security, data privacy, and the protection of personal information.