Quest Diagnostics Sign. Photo: Ken Wolter/Shutterstock.com

In the wake of a massive data breach of New Jersey-based Quest Diagnostics, the attorneys general of Connecticut and Illinois announced Friday they have opened up an investigation into the matter.

Meanwhile, Florida plaintiffs law firm Morgan & Morgan filed a putative class action in New Jersey against the laboratory testing company.

Quest Diagnostics had said the breach might have exposed the personal information of nearly 12 million Quest patients and 7.7 million Laboratory Corp. of America patients. The breach was reportedly the result of malicious activity on the web payment page of American Medical Collection Agency, a third-party collection vendor for the two medical testing companies.

The announcement from Connecticut Attorney General William Tong and Illinois Attorney General Kwame Raoul comes two days after Florida plaintiff Traci Julin filed a prospective class action against Quest, AMCA and Optum360 LLC, which provides billing collection services to the health industry.

In a statement, Tong said the investigation is needed because “sensitive personal information of millions of patients may have been compromised.

“I am deeply concerned about the adequacy of the plans in place to notify and protect all affected individuals,” he said. “It is important to determine the cause of this serious data breach and what steps these companies are taking to ensure this does not happen again.”

Meanwhile, plaintiff Julin, a frequent Quest patient, filed the prospective class action Wednesday in the U.S. District Court for the District of New Jersey.

Her 36-page lawsuit says the company failed to properly notify patients of the breach, waiting two months before disclosure.

As “proximate results of defendant's unconscionable or deceptive acts and practices, plaintiff and class members suffered an ascertainable loss in money or property, real or personal … including the loss of their legally protected interest in the confidentiality and privacy of their PII [personally identifiable information],” the suit claims.

The complaint adds: “Defendants have not disclosed the full extent and nature of the data breach, nor offered anything to its patients to address and compensate the harm they have suffered,”

Quest said the exposure occurred between Aug. 1, 2018 and March 30, 2019.

The breach, the lawsuit says, “was a direct result of defendants' failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect patient PII.”

The lawsuit seeks class certification, monetary damages and a mandatory injunction directing the defendants to adequately safeguard the class' personal information and implement improved security procedures.

No one from Quest's media relations department responded to a request for comment Friday and the company had not assigned an attorney to represent it in the lawsuit.

But the company posted a statement on its website, saying: “Quest is taking this matter very seriously and is committed to the privacy and security of our patients' personal information. Since learning of the AMCA data security incident, we have suspended sending collection requests to AMCA. … Quest is working with AMCA and Optum360 to ensure that Quest patients are appropriately notified consistent with the law.”

Representing the plaintiffs are James Barry of Cherry Hill, New Jersey-based Locks Law Firm, John Yanchunis and Patrick Barthle of Morgan & Morgan in Florida, Michael Galpern of New Jersey-based Javerbaum Wurgaft Hicks Kahn Wikstrom and Sinins, and Jared Lee of Longwood, Florida-based Jackson Lee.

In an emailed statement, Yanchunis said, “These companies, like Quest Diagnostics, know they are at an increased risk and yet have not taken the proper steps to protect their patients' data. We will fight for justice on behalf of those impacted by this breach.”

Will Rasmussen of New York City-based Brunswick Group, a communications and advisory firm, issued the following statement on behalf of AMCA: “We are investigating a data incident involving an unauthorized user accessing the American Medical Collection Agency system. Upon receiving information from a security compliance firm that works with credit card companies of a possible security compromise, we conducted an internal review, and then took down our web payments page. We hired a third-party external forensics firm to investigate any potential security breach in our systems, migrated our web payments portal services to a third-party vendor, and retained additional experts to advise on, and implement, steps to increase our systems' security. We have also advised law enforcement of this incident. AMCA is providing 24 months of credit monitoring to anyone who had a Social Security number or credit card account compromised, even if the relevant state doesn't require it. We remain committed to our system's security, data privacy, and the protection of personal information.”

No one was available at press time from Optum360's media relations team.