Major US clinic denies any unauthorized transfer of medical records

UPDATE LabCorp responded to The Daily Swig's request for comment, explaining that the intrusion on its network “was subsequently determined to be a new variant of ransomware" found only on LabCorp Diagnostics systems. Systems related to the company's drug development were not affected. The clinic reiterated that there was no evidence of data misuse, and that it was working to "restore full system functionality as quickly as possible." LabCorp added: “Testing operations have substantially resumed, and we are working to restore additional systems and functions over the next several days."

Services at a major US blood clinic were shut down over the weekend after “suspicious activity” was detected on its network, forcing the company to take certain servers offline. 

LabCorp, the operator of one of the world’s largest clinical laboratories, which also leads extensive drug development programs, said its “test processing” and “customer access to test results” were temporarily unavailable, following the incident which began on July, 14.

Fears that assailants were able to acquire customers’ medical records – far more lucrative to criminals than credit card details at a $10 a pop minimum – naturally spread like wildfire, with a company insider telling The Daily Mail that “private medical information of millions of patients may have been accessed”.

The Fortune 500 company filed a statement to the Securities and Exchange Commission (SEC), the federal agency responsible for imposing cybersecurity best practice for business, yesterday. 

It said: “The suspicious activity has been detected only on LabCorp Diagnostics systems. There is no indication that it affected systems used by Covance Drug Development.

“At this time, there is no evidence of unauthorized transfer or misuse of data. LabCorp has notified the relevant authorities of the suspicious activity and will cooperate in any investigation.”

The Daily Swig reached out to LabCorp for comment, but the company has yet to say whether its services are back up and running as normal.

It added: “Some customers of LabCorp Diagnostics may experience brief delays in receiving results as we complete that process.”

While the testing lab appears to have acted in accordance with responsible data breach disclosure, it comes as no surprise that customers may be concerned, or indeed, that the facility was targeted, as the healthcare sector globally continues to lag behind in implementing proper cybersecurity measures.

Earlier this year in Texas, thousands of hospital patients were alerted to a security incident that saw sensitive information such as medical record numbers, insurance information, clinical information, and Social Security numbers stolen.

The company affected, Texas Health Resources, said: “For those patients whose Social Security numbers were included, we are offering one year of free credit monitoring. We recommend affected patients review any statements they receive from their health insurer.”