LabCorp, a medical testing company, said 7.7 million customers had their personal and financial data exposed through a breach at a third-party billing collections company.
"We remain committed to our system's security, data privacy, and the protection of personal information", the company said.
Nessel's office determined that Quest Diagnostics reported to the US Securities and Exchange Commission that between August 1, 2018 and March 30, 2019, an unauthorized user had access to AMCA's system, which included financial information like credit card numbers and bank account information, medical information and other personal information including social security numbers.
The American Medical Collection Agency doesn't store Social Security numbers and insurance identification information of LabCorp patients. AMCA specializes in collecting overdue payments from people who haven't paid their medical bills, and the AMCA website says its clients include "hospitals", "physician groups" and "third-party providers" as well as clinical labs.
"LabCorp is working closely with AMCA to obtain more information and to take additional steps as may be appropriate once more is known about the AMCA incident", LabCorp wrote in its filing.
AMCA first notified Quest on May 14 of "potential unauthorized activity" on its payment page, Quest said. Unlike LabCorp, Quest said the exposed information may have included Social Security numbers and medical information, but not test results.
AMCA did not immediately respond to a request for comment on the disparity between the 7.7 million and 200,000 figures.
According to the Identity Theft Resource Center, almost 447 million records were exposed in 1,244 breaches previous year. The biggest hack of 2018, against Marriott International, affected 383 million people worldwide.
"This data breach is yet another example of how fragile our information infrastructure is, and how vulnerable all of us are to cyber hacking", Attorney General Dana Nessel said. Just this month, the U.S. Justice Department charged two Chinese nationals in the attack.