Quest Diagnostics Sign. Quest Diagnostics. Photo: Shutterstock.com

In the wake of a massive data breach at New Jersey-based Quest Diagnostics, Florida-based plaintiffs firm Morgan & Morgan filed a putative class action in the laboratory testing company’s home state.

Attorneys general in Connecticut and Illinois followed up Friday by announcing they opened investigations into the breach.

Quest Diagnostics said the breach might have exposed the personal information of nearly 12 million Quest patients and 7.7 million Laboratory Corp. of America patients. The breach was reportedly the result of malicious activity on the web payment page of American Medical Collection Agency, a third-party collection vendor for the two testing companies.

Traci Julin of Lake Mary, Florida, a frequent Quest patient, filed a prospective class action against Quest, AMCA and Optum360 LLC, which provides billing collection services to the health industry, Wednesday in U.S. District Court for the District of New Jersey.

Representing the plaintiffs are John Yanchunis and Patrick Barthle of Morgan & Morgan in Tampa, Jared Lee of Longwood, Florida-based Jackson Lee, James Barry of Cherry Hill, New Jersey-based Locks Law Firm and Michael Galpern of New Jersey-based Javerbaum Wurgaft Hicks Kahn Wikstrom and Sinins.

In an emailed statement, Yanchunis said: “These companies, like Quest Diagnostics, know they are at an increased risk and yet have not taken the proper steps to protect their patients’ data. We will fight for justice on behalf of those impacted by this breach.”

Yanchunia filed the first lawsuit over Marriott International Inc.’s data breach and was lead counsel in the $85 million Yahoo data breach settlement.

The 36-page lawsuit said the company failed to properly notify patients of the breach, waiting two months before disclosure.

As “proximate results of defendant’s unconscionable or deceptive acts and practices, plaintiff and class members suffered an ascertainable loss in money or property, real or personal … including the loss of their legally protected interest in the confidentiality and privacy of their PII,” or personally identifiable information, the suit claimed.

The complaint added, “Defendants have not disclosed the full extent and nature of the data breach, nor offered anything to its patients to address and compensate the harm they have suffered,”

Quest said the exposure occurred between Aug. 1, 2018, and March 30, 2019.

The breach “was a direct result of defendants’ failure to implement adequate and reasonable cyber-security procedures and protocols necessary to protect patient PII,” the lawsuit said.

The lawsuit seeks class certification, monetary damages and a mandatory injunction directing the defendants to adequately safeguard the class’ personal information and implement improved security procedures.

No one from Quest’s media relations department responded to a request for comment by deadline Friday, and the company had not assigned an attorney to represent it in the lawsuit.

But the company posted a statement on its website, saying: “Quest is taking this matter very seriously and is committed to the privacy and security of our patients’ personal information. Since learning of the AMCA data security incident, we have suspended sending collection requests to AMCA. … Quest is working with AMCA and Optum360 to ensure that Quest patients are appropriately notified consistent with the law.”

Will Rasmussen of New York City-based Brunswick Group, a communications and advisory firm, issued the following statement on behalf of AMCA saying the company received word of “a possible security compromise” from a security compliance company that works with credit card companies.

“We conducted an internal review, and then took down our web payments page. We hired a third-party external forensics firm to investigate any potential security breach in our systems, migrated our web payments portal services to a third-party vendor, and retained additional experts to advise on, and implement, steps to increase our systems’ security,” the statement said.

The company said it’s still investigating and notified law enforcement of the breach. The company is offering 24 months of credit monitoring to anyone whose Social Security number or credit card account was compromised.

Optum360′s had no comment by deadline.

The state investigations are being led by Connecticut Attorney General William Tong and Illinois Attorney General Kwame Raoul.

In a statement, Tong said the investigation is needed because “sensitive personal information of millions of patients may have been compromised.

“I am deeply concerned about the adequacy of the plans in place to notify and protect all affected individuals,” he said. “It is important to determine the cause of this serious data breach and what steps these companies are taking to ensure this does not happen again.”