A data breach at American Medical Collection Agency has affected nearly 12 million patients who had lab tests performed by Quest Diagnostics. The incident, which appears to be the biggest health data breach to be revealed so far in 2019, exposed financial data, Social Security numbers and certain medical information, the lab test firm reports. In a statement Monday, Secaucus, New Jersey-based Quest Diagnostics says AMCA, based in Elmsford, New York, informed the lab testing firm in May that an “unauthorized user” had access to AMCA’s system containing personal information the collections agency received from various entities, including from Quest.

David Bailey, vice president of consulting services at Clearwater, a firm focused on cybersecurity in healthcare, told Fierce in an interview that the incident highlighted challenges in healthcare beyond fending off digital threats, as organizations grappled with a key service taken offline.