In the wake of a massive data breach, New Jersey-based laboratory testing company Quest Diagnostics is facing investigations from the attorneys general of Connecticut and Illinois, as well as a putative class action in New Jersey.

The company, headquartered in Secaucus, had said the breach might have exposed the personal information of nearly 12 million Quest patients and 7.7 million Laboratory Corp. of America patients. The breach was reportedly the result of malicious activity on the web payment page of American Medical Collection Agency, a third-party collection vendor for the two medical testing companies.

The June 7 announcement from Connecticut Attorney General William Tong and Illinois Attorney General Kwame Raoul came two days after a prospective class action was filed in New Jersey federal court against Quest, AMCA and Optum360 LLC, which provides billing collection services to the health industry.

In a statement, Tong said the investigation is needed because “sensitive personal information of millions of patients may have been compromised, and I am deeply concerned about the adequacy of the plans in place to notify and protect all affected individuals,” he said. “It is important to determine the cause of this serious data breach and what steps these companies are taking to ensure this does not happen again.”

Meanwhile, Florida plaintiff Traci Julin, a frequent Quest patient, filed the prospective class action June 5 in the U.S. District Court for the District of New Jersey.

Representing the plaintiffs are James Barry of Cherry Hill-based Locks Law Firm, John Yanchunis and Patrick Barthle of Morgan & Morgan in Florida, Michael Galpern of Javerbaum Wurgaft Hicks Kahn Wikstrom & Sinins in Springfield, and Jared Lee of Longwood, Florida-based Jackson Lee.

The 36-page lawsuit says the company failed to properly notify patients of the breach, waiting two months before disclosure.

As “proximate results of defendant's unconscionable or deceptive acts and practices, plaintiff and class members suffered an ascertainable loss in money or property, real or personal … including the loss of their legally protected interest in the confidentiality and privacy of their PII [personally identifiable information],” the suit claims.

The complaint adds: “Defendants have not disclosed the full extent and nature of the data breach, nor offered anything to its patients to address and compensate the harm they have suffered.”

Quest said the exposure occurred between Aug. 1, 2018, and March 30, 2019.

The breach, the lawsuit says, “was a direct result of defendants' failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect patient PII.”

The lawsuit seeks class certification, monetary damages and a mandatory injunction directing the defendants to adequately safeguard the class' personal information and implement improved security procedures.

No one from Quest's media relations department responded to a request for comment June 7, and the company had not assigned an attorney to represent it in the lawsuit as of that date.

But the company posted a statement on its website, saying: “Quest is taking this matter very seriously and is committed to the privacy and security of our patients' personal information. Since learning of the AMCA data security incident, we have suspended sending collection requests to AMCA. … Quest is working with AMCA and Optum360 to ensure that Quest patients are appropriately notified consistent with the law.”

In an emailed statement, Yanchunis said, “These companies, like Quest Diagnostics, know they are at an increased risk and yet have not taken the proper steps to protect their patients' data. We will fight for justice on behalf of those impacted by this breach.”

Will Rasmussen of New York City-based Brunswick Group, a communications and advisory firm, issued the following statement on behalf of AMCA: “We are investigating a data incident involving an unauthorized user accessing the American Medical Collection Agency system. Upon receiving information from a security compliance firm that works with credit card companies of a possible security compromise, we conducted an internal review, and then took down our web payments page. We hired a third-party external forensics firm to investigate any potential security breach in our systems, migrated our web payments portal services to a third-party vendor, and retained additional experts to advise on, and implement, steps to increase our systems' security. We have also advised law enforcement of this incident. AMCA is providing 24 months of credit monitoring to anyone who had a Social Security number or credit card account compromised, even if the relevant state doesn't require it. We remain committed to our system's security, data privacy, and the protection of personal information.”

No one was available from Optum360's media relations team.