Labcorp to pay $2.3 million and overhaul security

Forty-four state attorneys general settled with Labcorp for $2.3 million and mandated security reforms tied to the 2019 AMCA breach.

A bipartisan coalition of 44 U.S. state attorneys general settled with Labcorp over cybersecurity failings tied to a 2019 breach at debt collector American Medical Collection Agency. Labcorp agreed to pay a $2.3 million fine and to overhaul its data-security practices, including vendor incident-response planning, limits on data shared with vendors, contractual cybersecurity requirements, routine vendor audits, an independent security assessment, and data siloing. The Record reported that the incident exposed data on 10.2 million Labcorp customers and was part of an AMCA breach affecting 27.5 million people nationwide; DataBreaches.net did not cite those figures and described the announcement as a litigation update rather than a new incident. In 2021, a court ordered bankrupt AMCA to pay a suspended $21 million fine, according to The Record. The reports agree on the settlement amount, the number of states, and the 2019 origin of the case.

• Forty-four state attorneys general settled with Labcorp for a $2.3 million fine.
• The case stems from a 2019 breach at debt collector American Medical Collection Agency, not a newly disclosed incident.
• The Record said the breach exposed data on 10.2 million Labcorp customers and was part of an AMCA incident affecting 27.5 million people nationwide; DataBreaches.net did not cite those totals.
• Required reforms include vendor incident-response planning, limits on data shared with vendors, contractual cybersecurity requirements, routine vendor audits, an independent security assessment, and data siloing.
• In 2021 a court ordered bankrupt AMCA to pay a suspended $21 million fine, according to The Record.