Nearly 12 million people may have had their financial and medical information put at risk by a data breach involving Quest Diagnostics.

Quest says hackers broke into the network of American Medical Collection Agency, a company it used for billing, and the breach wasn’t discovered for eight months. In a written statement Quest says the information compromised “includes personal information, including certain financial data, Social Security numbers, and medical information, but not laboratory test results.”

“They were a bill collector,” says CyberScout chairman Adam Levin, a cybersecurity expert. “And unfortunately, they had a treasure trove of data.”

Levin says it’s not uncommon for companies not to discover data breaches for weeks or months because, “hackers are sophisticated, they're creative, they're persistent, and they know when to lay in wait. They gather as much info as possible and then they start moving it out, sometimes so subtly that an organization can't even tell that data is being moved out because it looks like a normal operating practice.”

If you’re a potential victim of the data breach, Kane In Your Corner advises checking your credit report and financial statements for unauthorized activity. Consider a credit freeze, to stop people from obtaining new credit in your name. And since medical information is involved, keep an eye on the Explanation of Benefits forms from your insurance company.

Finally, many experts advise trying to avoid giving out your Social Security number to medical providers, since they really have no need for it except to make billing easier. But that’s not always possible. Under the law, you’re not required to provide an SSN but medical providers are also not required to treat patients who don’t provide it.