Consumer Alert: Attorney General Frosh Warns Marylanders of Massive Medical Data Breach

American Medical Collection Agency Experienced Cyberattack; Patient Personal Data May Be at Risk

 

BALTIMORE, MD  – Maryland Attorney General Brian E. Frosh is warning Marylanders that their medical and other private information may have been compromised by a cyberattack against American Medical Collection Agency (AMCA), a third party collection agency for laboratories, hospitals, physician groups, medical providers, and others.

Presently, the known list of impacted entities affects over 20 million patients.  The list is likely to expand and includes the following entities:

• Quest Diagnostics: 11.9 million patients
• LabCorp: 7.7 million patients
• BioReference Laboratories: 422,600 patients
• Carecentrix: 500,000 patients
• Sunrise Laboratories: unknown number of patients

The compromised information varies for each entity, but includes some or all of the following information: patient name, date of birth, address, phone number, date of service, provider, balance information, payment card information, bank account information, social security number, and the lab test performed. 

AMCA’s payment system was compromised on August 1, 2018, and remained vulnerable through March 30, 2019.  AMCA has started sending out written notices to consumers whose credit card number, social security number, or lab test order information may have been accessed.

Recent reports of massive data breaches highlight the need for Marylanders to be vigilant about their personal information and aware of how it may be compromised and misused.  The Maryland Personal Information Protection Act (PIPA) requires any business that keeps electronic records containing the personal identifying information of Maryland residents to notify those residents if their information is compromised.  

Consumers should always carefully review their financial and medical account regularly for suspicious activity and immediately report all suspicious or fraudulent charges to their financial institutions or health insurance providers.  Consumers impacted by the AMCA data breach should be especially vigilant.

“Massive data breaches like the one experienced by the AMCA are extremely alarming, especially considering the likelihood that personal, financial, and medical information may now be in the hands of thieves and scammers,” said Attorney General Frosh.  “I strongly urge consumers to take steps to ensure that their information and personal identity is protected.”

Consumers who believe they may have been affected by this breach should immediately take the following steps to protect their information:

• Obtain a free credit report at www.annualcreditreport.com or by calling 877-322-8228.
• Put a fraud alert on your credit file.
• Consider a security freeze on your credit file (for more information about freezes, visithttp://www.marylandattorneygeneral.gov/Pages/IdentityTheft/freezing.aspx).
• Take advantage of any free services being offered as a result of the breach.
• Use two-factor authentication on your online accounts whenever available.

The Office of the Attorney General has an Identity Theft Unit that offers guidance and assistance.  Information about protecting yourself or your children against identity theft, and what to do if it occurs, can be found atwww.marylandattorneygeneral.gov/Pages/IdentityTheft/default.aspx.

If consumers feel they have been harmed and want to file a complaint, they may call the Attorney General’s Identity Theft Unit at 410-576-6491.