A 2019 breach at American Medical Collection Agency, Labcorp’s debt collection vendor, affected more than 10.2 million Labcorp patients. Years later, Labcorp has agreed to a $2.3 million multistate settlement over the incident.
Over the past few weeks, the ColorTokens Threat Intelligence team has been tracking the consequences of data theft across healthcare and defense. Stolen records can leave companies facing new obligations and individuals exposed to fraud long after affected systems are secured.
The Exposure Can Sit Outside Your Network
For Labcorp, the settlement changes how it must handle patient information beyond its own systems. The company must limit what it shares with debt collectors and strengthen vendor assessments. Its response plans must cover vendor security incidents, with procedures for alerting senior management. An independent assessment must also examine its security practices, with a focus on vendor risk.
Client information can also be exposed through a supplier’s everyday business tools. At Bridgeway Benefit Technologies, a breached employee email account exposed health information belonging to 9,268 people. Clients had supplied that information for benefits administration. None of their own systems were compromised.
Blocking Ransomware Can Still Leave Patient Data Exposed
Providers facing attacks on their own systems can be left with the same concern about exposed records. In Maine, Gardiner Family Chiropractic said it blocked a ransomware attack and paid no ransom. Its breach notice nevertheless described file encryption and data theft in an incident affecting up to 5,000 patients.
Names, birth dates, contact information, and health or insurance details were potentially compromised. The clinic wiped affected devices, bought new computers, and trained its workforce on ransomware.
Read More: Securing Hospitals with Microsegmentation explains how healthcare organizations can protect sensitive patient data, restrict unauthorized access, and limit malware spread.
At Crystal Coast Pain Management in North Carolina, attackers had copied patient files containing Social Security numbers and medical information. Outside experts later confirmed the network was secure, but the practice still wiped and rebuilt affected systems as a precaution.
The practice also offered credit monitoring to affected individuals, even though it had found no evidence that their information had been misused.
The Stakes Reach Beyond Patient Files
The ransomware claims against Interim HealthCare extend from patient information into the provider’s business operations. Genesis claimed theft of medical records and patient lists relating to the provider’s Oklahoma and Tulsa operations. Anubis separately claimed 530 gigabytes that included franchisee financial information, audit details, and internal discussions of operational issues.
Stolen Social Security numbers can expose individuals to financial harm beyond the organization that lost the data. The advisory describes a reported breach affecting an estimated four million United States Department of Defense personnel. Social Security numbers and other sensitive information were reportedly compromised.
Those details could support identity theft, targeted phishing, or blackmail. Misuse could also disrupt pay or benefits, creating problems that may be harder to resolve for someone serving overseas.
A Security Tool Can Become an Entry Point
Protecting sensitive records also means addressing software weaknesses that could give attackers access. Some of those weaknesses affect the tools used to manage security.
One of the advisory’s most severe flaws sits in Cisco Secure Firewall Management Center. Rated 10.0 in the report, it could let an attacker bypass sign-in checks and gain full control of an affected device without credentials.
F5 BIG-IP’s 9.8-rated flaw could also let an attacker run code without signing in. It applies only to a specific authorization-server configuration in its Access Policy Manager. Teams need to check that configuration to determine whether their deployment is affected.
Other weaknesses involve the applications and devices people use. Microsoft SharePoint Server’s 9.1-rated flaw could let an attacker bypass a security check over a network. Apple’s 9.9-rated flaw could let a malicious file trigger code execution.
Also Read: The Anthropic Mythos, Project Glasswing, and the Illusion of Patch-Based Security examines why patching alone is insufficient and how microsegmentation can help contain threats when vulnerable systems remain exposed.
How Security Teams Can Limit Data Exposure
- Limit patient information shared with debt collectors and assess the vendors handling those records.
- Include vendor security incidents in response plans and reporting procedures for senior management.
- Review employee security training, including ransomware awareness, wherever staff handle sensitive information.
- Prioritize software updates using affected versions, configurations, and exposure, with compatibility testing before deployment.
- Monitor official advisories and threat intelligence for changes to vulnerabilities and available patches.
- Use microsegmentation to restrict network access and limit how far an attacker can move.
Access the CISO’s Guide to Containment in the Age of AI Attacks explores how EDR-integrated microsegmentation can reduce attacker reachability and strengthen containment.
Labcorp’s settlement sets out new obligations for the company. For the people named in stolen records, the unresolved question is how that information might be used. Securing a system cannot answer that on its own.
Access the full ColorTokens Threat Advisory for the incident details, affected software versions, and vendor guidance behind these findings.
Talk to our advisors about limiting access to sensitive records and containing threats across your environment.
