Labcorp settles multistate data breach for $2.3 million

Labcorp has agreed to a $2.3 million multistate settlement following a 2019 data breach at its former debt collection vendor, the American Medical Collection Agency (AMCA). The breach, which occurred between August 2018 and March 2019, compromised the personal and medical information of approximately 27.5 million Americans, including roughly 10.2 million Labcorp patients.

As part of the settlement involving a bipartisan coalition of 44 attorneys general, Labcorp will implement reforms to enhance consumer protection. These measures include revamping data security policies and establishing a new data-sharing system for third-party debt collectors.

The breach exposed sensitive data such as names, Social Security numbers, payment card information, and specific medical tests. While the unauthorized access originated on AMCA’s servers, regulators focused on how healthcare entities manage third-party data handlers. The settlement follows a separate $35 million class-action resolution and a $21 million suspended payment related to AMCA’s bankruptcy proceedings.