The Maine Office of the Attorney General reported a data breach involving Quest Diagnostics on October 25, 2024. The breach, which was discovered on August 27, 2024, involved inadvertent disclosure of personal information and affected a total of 1,062 individuals, including 4 residents of Maine.

Quest Diagnostics suffered from a data breach that exposed 350,000 patients' protected health information. Before the attacker may have acquired or exfiltrated specific patient health information, the security team discovered the intrusion two days after the ransomware was distributed. The compromised data includes medical histories, test reports, CPT and diagnosis codes, and other data provided, as well as billing and further health data. The Quest investigated the incident and notified those affected by email.

The California Office of the Attorney General reported a data breach involving Quest Diagnostics on November 16, 2021. The breach occurred on October 29, 2021, due to an inadvertent email sent containing a spreadsheet with personal information of current and former employees. The information included names, Social Security Numbers, and employee ID numbers, with some individuals potentially having personal email addresses compromised.

Labcorp Agrees to $35 Million Settlement Over 2018–2019 AMCA Data Breach Laboratory Corporation of America Holdings (Labcorp) has agreed to a $35 million class action settlement to resolve claims stemming from a 2018–2019 cybersecurity incident involving its third-party billing vendor, American Medical Collection Agency (AMCA). The breach exposed the personal and health information of patients whose data Labcorp transmitted to AMCA between August 2018 and March 2019. ### Eligibility and Compensation Affected individuals may qualify for compensation if their data was compromised in the AMCA breach. Claimants can seek: - Up to $5,000 for documented out-of-pocket losses, including expenses related to identity theft, medical fraud, credit monitoring, legal services, and up to 10 hours of remedial time at $25/hour. - A $50 alternative cash payment for those without documented losses, though the final amount may adjust based on the number of valid claims. - Two years of free medical monitoring via CyEx Medical Shield Pro. ### Settlement Process and Deadlines Claims can be filed online or by mail to the settlement administrator, Kroll Settlement Administration, by September 3, 2026. Required documentation varies by claim type, with receipts or records needed for out-of-pocket losses. Payments will be distributed via electronic transfer or mailed check after final court approval. Key dates: - Opt-out deadline: July 27, 2026 - Final fairness hearing: August 20, 2026 - Claim filing deadline: September 3, 2026 ### Settlement Fund Allocation The $35 million fund will cover: - Up to $11.67 million in attorneys’ fees - $5,000 service awards for class representatives - Administrative costs, medical monitoring expenses, and remaining payouts to eligible claimants ### Background and Legal Context The lawsuit alleged Labcorp failed to adequately protect patient data shared with AMCA, whose systems were breached. Labcorp denies wrongdoing, stating the settlement avoids litigation costs while providing relief to affected individuals. The breach, disclosed in 2019, also impacted other AMCA clients, including Quest Diagnostics, which settled separately for $195 million in 2022. Payments will be issued after the court resolves any appeals and grants final approval.

The California Office of the Attorney General reported a data breach involving Quest Diagnostics on December 12, 2016. The breach occurred on November 26, 2016, when an unauthorized third party accessed the MyQuest by Care360® internet application, compromising Protected Health Information (PHI) of approximately 34,000 patients, which included names, dates of birth, and lab results.

The California Office of the Attorney General reported a data breach involving Quest Diagnostics on December 19, 2014. The breach occurred on November 17, 2014, when an employee mistakenly sent personal information via secured email to outside parties. Approximately 34,000 individuals were affected, with compromised information including names, addresses, Social Security numbers, and dates of birth.