Patient Sues Abbott Labs, Exact Sciences in Data Theft

The first of what could be many more proposed class action lawsuits has been filed in a U.S. federal court against clinical testing laboratory and medical device maker Abbott Laboratories and its cancer diagnostics business Exact Sciences in the wake of a data theft hack claimed last week by notorious cybercrime gang ShinyHunters.

See Also: The Unstructured Data Blindspot: Why Your Most Valuable Assets Are Your Least Protected

The lawsuit filed in an Illinois federal court alleges, among other claims, that the Illinois-based Abbott and its Exact Sciences business – which provides cancer screenings, diagnostic testing, and related laboratory services to patients and healthcare providers in the United States – failed to implement “necessary data security safeguards” to protect the plaintiff’s and class members’ sensitive personal and health information from unauthorized access and theft by cybercriminals.

“The data breach and the injuries it caused to plaintiff and class members occurred as direct, proximate and foreseeable results of multiple failings on the part of defendants,” alleges the lawsuit filed on Wednesday by Brian Troesch – a patient of Exact Sciences, on behalf of himself and other individuals similar situated. “This failure resulted in cybercriminals accessing the private information of defendants’ current and former patients.”

The lawsuit is seeking monetary damages as well as injunctive relief requiring Abbott and Exact Sciences to strengthen their data security systems and monitoring procedures and conduct periodic audits of those IT systems. In addition, the lawsuit wants Abbott to provide “lifetime credit monitoring and identity theft insurance to plaintiff and class members.”

Abbott Labs in a July 16 statement posted on its website acknowledged it’s investigating a breach involving its Exact Sciences business.

Abbott said the incident appears to involve unauthorized access to a limited number of internal systems in the company’s Cancer Diagnostics business only (see: Craneware, Abbott Probe Separate Health Data Theft Incidents).

“This does not impact any business operations, product or product availability, manufacturing or lab operations, or our ability to serve patients,” the company said. “There is no impact to any other Abbott businesses, sites or systems. The legacy Exact Sciences systems are separate from Abbott’s.”

But the Exact Sciences incident is not the only alleged hack Abbott confirmed it’s investigating. The company in a statement to ISMG on Monday acknowledged that the company is also investigating claims that another threat actor gained access to Abbott’s LabCentral portal.

Cybercrime gang ShadowByt3$ claimed to media outlet Bleeping Computer this week to have exfiltrated an array of manufacturing certificates, operation manuals, technical specifications, regulatory documentation, product requirement archives, calibrator value assignments, assay files and other product documentation related to Abbott’s laboratory diagnostic systems.

ShinyHunters on its dark website on Friday still listed “Abbott-owned Exact Sciences” as a victim, indicating that it had extended until July 21 its threat for the company to “pay or leak.”

“We have made an extension to your deadline. We are issuing one last final warning due to the severity of this case. You wouldn’t want us to describe what was exfiltrated from you publicly,” ShinyHunters wrote. As of Friday, which was three days after that supposed final deadline, ShinyHunters had appeared to not yet begin leaking Abbott’s data.

Abbott on Friday declined further comment to ISMG on either cyber incident, ShinyHunter’s latest threats or the proposed class action lawsuit filed by Troesch.