Labcorp Reaches $2.3 Million Multistate Settlement Over 2019 Data Breach Affecting Millions Nevada has joined a 44-state coalition in a $2.3 million settlement with Laboratory Corporation of America (Labcorp) following a 2019 cybersecurity breach that exposed the personal and health data of over 27.5 million Americans. The incident stemmed from a third-party vendor, Retrieval-Masters Creditors Bureau (operating as the American Medical Collection Agency, or AMCA), which suffered the breach on its servers. The settlement, announced by Nevada Attorney General Aaron D. Ford, resolves a multistate investigation into Labcorp’s oversight of AMCA, which handled medical debt collection for the company. Under the agreement, Labcorp will pay $2,287,455 to the participating states, with Nevada receiving $31,178. The company has also agreed to a separate $35 million settlement in a related federal class-action lawsuit. The breach compromised sensitive data for approximately 10.2 million Labcorp patients nationwide, including 123,412 Nevada residents 11,805 of whom had their Social Security numbers exposed. Labcorp operates 20 patient service centers in Nevada, including locations in Las Vegas, Henderson, and North Las Vegas. State investigators determined that while the breach occurred on AMCA’s systems, healthcare entities like Labcorp remain responsible for ensuring third-party vendors comply with data protection standards under HIPAA. As part of the settlement, Labcorp must implement stricter vendor oversight measures, including: - Limiting patient data shared with debt collectors to only what is legally required. - Establishing a dedicated vendor risk management team with continuous compliance auditing tools. - Requiring third-party cybersecurity audits, data segmentation, and contract clauses allowing immediate termination for security failures. - Enhancing incident response procedures to track vendor-related security incidents. - Engaging an independent third-party assessor to review Labcorp’s information security posture. The multistate investigation was led by attorneys general from Connecticut, Florida, Indiana, Illinois, Michigan, and Texas, with support from an executive committee including New York, Tennessee, Maryland, and North Carolina.

Labcorp Agrees to $6.1 Million Settlement Over 2024 Data Breach Impacting 1.6 Million Labcorp has reached a $6.1 million settlement to resolve a class action lawsuit stemming from a data breach discovered in October 2024. The incident exposed the personal and health information of approximately 1.6 million individuals, including current and former employees, as well as patients who received or paid for laboratory tests ordered by Planned Parenthood health centers on or before October 27, 2024. The breach compromised sensitive data such as names, dates of birth, Social Security numbers, and medical records, including lab results. Eligible claimants U.S. residents whose information was potentially exposed may receive compensation for documented out-of-pocket losses (up to $5,000), a pro rata cash payment (up to $1,000), or two years of free credit and medical monitoring through CyEx Medical Shield Complete. To file a claim, affected individuals must submit documentation by November 24, 2026, either online or via mail to the settlement administrator. Payments will be distributed after final approval, expected following a hearing on January 4, 2027, and resolution of any appeals. The settlement fund will cover administrative costs, attorneys’ fees (up to $2.03 million), service awards for class representatives, and remaining payouts to claimants. Labcorp denies wrongdoing but agreed to the settlement to avoid prolonged litigation. The breach was first identified by Laboratory Services Cooperative.

Labcorp Settles Multistate Data Breach Investigation Over 2019 AMCA Incident Nebraska Attorney General Mike Hilgers announced a settlement between Labcorp and a coalition of 44 state attorneys general, resolving a multistate investigation into a 2019 data breach at Retrieval-Masters Creditors Bureau (AMCA), Labcorp’s debt collection vendor. The breach exposed the personal and sensitive information of over 27.5 million individuals nationwide, including 10.2 million Labcorp patients, with 9,777 Nebraska residents affected. The breach occurred at AMCA, but the compromised data belonged to Labcorp’s patients, highlighting the risks of third-party vendor management in cybersecurity. While companies can outsource operations, they remain responsible for safeguarding customer data a principle reinforced by the settlement. Under the agreement, Labcorp must implement enhanced vendor security measures, including: - Developing an incident response plan with internal reporting for vendor-related security events. - Minimizing data sharing with vendors while ensuring compliance with legal obligations. - Expanding its vendor risk management program, including dedicated teams, vendor evaluation tools, and compliance verification. - Applying specialized requirements for debt collectors, such as contract inventories, enforced cybersecurity standards, data segmentation, and audit rights. - Hiring a third-party assessor to evaluate its information security program, with a focus on vendor risk management. The settlement includes a $2.29 million payment to the participating states, with Nebraska receiving $16,661. The investigation was led by attorneys general from Connecticut, Florida, Indiana, Illinois, Michigan, and Texas, with support from an executive committee and additional states. The case underscores the growing scrutiny of vendor security practices and the legal accountability companies face for third-party breaches.

The California Office of the Attorney General reported that Laboratory Medicine Consultants, Ltd. experienced a data breach involving its vendor, Retrieval Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA). The breach, discovered on May 15, 2019, potentially exposed patient names, addresses, phone numbers, dates of birth, service dates, balance information, and treatment provider information. The breach occurred on May 15, 2019, with prior incidents dated August 1, 2018, and March 30, 2019.

Labcorp Settles $2.3M Over 2019 Data Breach Affecting 27.5 Million Patients A bipartisan coalition of 44 state attorneys general, led by New York Attorney General Letitia James, has secured a $2.3 million settlement with Labcorp over a 2019 data breach that exposed the personal and medical information of over 27.5 million people including 10.2 million Labcorp patients. The breach stemmed from a cyberattack on American Medical Collection Agency (AMCA), a third-party debt collector for Labcorp, between August 2018 and March 2019. Hackers infiltrated AMCA’s systems, compromising Social Security numbers, payment card details, and medical test information. Despite warnings from banks about suspicious activity, AMCA failed to detect the intrusion, resulting in one of the largest healthcare-related breaches in U.S. history. New York alone accounted for 420,000 affected individuals. Under the settlement, Labcorp must implement sweeping cybersecurity reforms, including: - Strengthening its information security program and incident response plan. - Minimizing data shared with vendors while ensuring compliance with legal obligations. - Expanding vendor risk management with dedicated oversight and compliance verification. - Enforcing stricter cybersecurity standards in vendor contracts, including data segmentation and regular audits. - Engaging a third-party assessor to evaluate its security practices, with a focus on vendor risk management. Labcorp will pay $2,287,455 to the participating states, including $89,178 to New York. The settlement follows a 2021 multistate agreement with AMCA, which included a $21 million penalty later suspended due to the company’s bankruptcy. The case reflects a broader enforcement trend by James’ office, which has secured multimillion-dollar settlements from companies like 23andMe, Illuminate Education, and auto insurers over similar data protection failures.

LabCorp, one of the largest clinical labs in the U.S., experienced Samsam ransomware attack. The ransomware was able to encrypt thousands of systems and several hundred production servers. The LabCorp SOC (Security Operation Center) immediately took action after that first system was encrypted, alerting IR teams and severing various links and connections. The quick actions neutralized the attack within 50 minutes. However, before the attack was fully contained, 7,000 systems and 1,900 servers were impacted. Of those 1,900 servers, 350 were production servers. Only Windows systems were impacted, nothing left the network during the attack, so the company is confident that there was no data breach.