Labcorp reaches $2.3 million settlement over data breach

Labcorp has reached a $2.3 million multistate settlement to resolve an investigation into a 2019 data breach. The breach occurred at the company’s debt collector, Retrieval-Masters Creditors Bureau, doing business as the American Medical Collection Agency (AMCA).

The incident potentially exposed the personal information of over 27.5 million individuals across the United States, including 10.2 million Labcorp patients. Of those, 451,558 are residents of Maryland. While the breach took place at AMCA, the sensitive data involved was collected by Labcorp.

As part of the settlement, Labcorp is required to implement stronger vendor oversight and expand its information security program. This includes updating incident response plans to cover vendor security events and minimizing the sharing of data with third parties.