Skip to main content

Massive Medical Data Breach Could Put Md. Consumers at Risk

By Deb Belt

Maryland patients whose medical bills were handled by a collection agency may be among 20 million patients who have had their personal information exposed in a data breach, Attorney General Brian E. Frosh said Friday. Medical and other private information may have been compromised by a cyberattack against American Medical Collection Agency, a third-party collection agency for laboratories, hospitals, physician groups, medical providers and others.

Frosh’s office said the list is likely to expand and includes the following businesses:

  • Quest Diagnostics: 11.9 million patients
  • LabCorp: 7.7 million patients
  • BioReference Laboratories: 422,600 patients
  • Carecentrix: 500,000 patients
  • Sunrise Laboratories: unknown number of patients

The compromised information varies for each company, but includes some or all of the following information: patient name, date of birth, address, phone number, date of service, provider, balance information, payment card information, bank account information, Social Security number and the lab test performed.

American Medical Collection Agency’s payment system was compromised Aug. 1, 2018, and remained vulnerable through March 30, 2019. The collection agency has started sending written notices to consumers whose credit card number, Social Security number or lab test order information may have been accessed.

Frosh’s office said recent reports of massive data breaches highlight the need for Marylanders to be vigilant about their personal information and aware of how it may be compromised and misused. The Maryland Personal Information Protection Act requires any business that keeps electronic records containing the personal identifying information of Maryland residents to notify those residents if their information is compromised.

Consumers should always review their financial and medical account regularly for suspicious activity and immediately report all irregular or fraudulent charges to their banks or health insurance providers.

“Massive data breaches like the one experienced by the AMCA are extremely alarming, especially considering the likelihood that personal, financial, and medical information may now be in the hands of thieves and scammers,” Frosh said in a news release. “I strongly urge consumers to take steps to ensure that their information and personal identity is protected.”

Consumers who believe they may have been affected by this breach should immediately take the following steps to protect their information:

  • Obtain a free credit report at or by calling 877-322-8228.
  • Put a fraud alert on your credit file.
  • Consider a security freeze on your credit file (for more information about freezes, visit the attorney general’s office website).
  • Take advantage of any free services being offered as a result of the breach.
  • Use two-factor authentication on your online accounts whenever available.

How to Protect Yourself from Identity Theft

Review your credit report from each of the three credit reporting agencies twice per year. You can stagger them so you are looking at a fresh report every two months. Under Maryland and federal law, you are entitled to two free credit reports from each of the credit reporting agencies each year. Go to or call 1-877-322-8228 to access your report through the federal Fair Credit Reporting Act. Contact each of the three credit reporting agencies individually to access your credit report under Maryland law: Equifax: 1-800-685-1111; Experian: 1-888-397-3742; and TransUnion: 1-800-680-7289.

Consumer Credit ‘Security Freezes’

A “security freeze” or “credit freeze” completely blocks the information on your credit report from would-be creditors. A credit freeze can help prevent identity theft. Most businesses will not open credit accounts without first checking a consumer’s credit history. If your credit files are frozen, even someone who has your name and Social Security number might not be able to get credit in your name. Maryland law prohibits credit reporting agencies from charging more than $5 per credit freeze. Anyone who is a victim of identity theft will be able to freeze his or her credit reports for free.

For more information, check out the guide on freezing your credit report.

The Office of the Attorney General has an Identity Theft Unit that offers guidance and assistance. Information about protecting yourself or your children against identity theft, and what to do if it occurs, can be found at

If consumers feel they have been harmed and want to file a complaint, they may call the Attorney General’s Identity Theft Unit at 410-576-6491.


Did someone forward this to you?
Get your own daily morning news roundup in your inbox. Free. Sign up here.


Our stories may be republished online or in print under Creative Commons license CC BY-NC-ND 4.0. We ask that you edit only for style or to shorten, provide proper attribution and link to our website. Please see our republishing guidelines for use of photos and graphics.

If you have any questions, please email editor Danielle Gaines at [email protected]

To republish, copy the following text and paste it into your HTML editor.


Creative Commons License AttributionCreative Commons Attribution
Massive Medical Data Breach Could Put Md. Consumers at Risk