Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings
Labcorp will pay $2.3 million and overhaul vendor security after a 2019 breach of 10.2 million customers.
A bipartisan coalition of 44 state attorneys general settled with Labcorp for a $2.3 million fine and mandated data-security reforms tied to a 2019 breach. The incident originated at debt collector American Medical Collection Agency and affected 10.2 million Labcorp customers, part of 27.5 million people impacted nationwide. Required changes include vendor incident-response planning, limits on data shared with vendors, contractual cybersecurity requirements, routine vendor audits, an independent security assessment, and data siloing. In 2021 a court ordered bankrupt AMCA to pay a suspended $21 million fine.
- Forty-four state attorneys general settled with Labcorp for $2.3 million.
- The 2019 breach via AMCA exposed data on 10.2 million Labcorp customers.
- The AMCA incident affected 27.5 million people nationwide; a $21 million AMCA fine was suspended after bankruptcy.
- Labcorp must tighten vendor contracts, limit data sharing, and add incident response and independent assessments.
- Victims
- Labcorp
- Organizations
- LabcorpAmerican Medical Collection Agency
- Countries
- United States
From the original article
1 min read at therecord.mediaSecurity changes include creating an incident response plan for vendor security failings, limiting how much data Labcorp shares with vendors and building an expansive risk management team charged with tracking vendors’ compliance with data security practices.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.