Most of us have had to send away some type of medical-related sample for analysis in a lab. One of the largest labs those samples may have been sent to is LabCorp. Indeed, LabCorp is one the largest medical diagnostic companies in this country and recently, it filed a report with the SEC stating it detected suspicious activity on its network one weekend in July. It took some systems offline and is investigating whatever that activity may be. However, just reading between the lines, it very well might have been a data breach putting millions of patients’ healthcare records at risk.
Healthcare data is valuable on the dark web. A single record can sell for more than $300. And the data included in them can be used for other things as well, such as tax fraud. After all your social security number is attached to your healthcare records. So when they get stolen, there are reasons to be concerned.
According to records with the U.S. Department of Health and Human Services (HHS), there were 477 healthcare data breaches last year reported to that office or to the media. These affected more than 5.5 records, per the company Protenus, which tracks breaches related to the healthcare industry.
LabCorp isn’t confirming a data breach. So, there hasn’t been any official disclosure thus far. They have stated that there is no evidence of access or misuse of any information. However, it has caused a company-wide shutdown of operations that are slowly being brought back online. Don’t wait to find out if you may have been affected, if it was an intrusion.
First, find out if your medical providers use LabCorp. Check your healthcare statement of benefits. If the doctors or services listed are not yours, contact your healthcare provider first to make sure it wasn’t an administrative mistake. Then contact your insurer. Watch for targeted phishing attacks. If it was an intrusion, they have a lot of information about you that can be used to trick you into giving up even more.
If it is discovered that a data breach occurred, LabCorp is required to notify patients within 60 days. No doubt more to this story is coming in the future.