"The system contained sensitive data, including credit card numbers, bank account information, medical information and Social Security numbers," said Quest officials in a statement. "Lab results were not provided to AMCA and were not exposed in the breach."