Cybersecurity Policy Report, State AGs Reach $2.3M Data Breach Settlement With Labcorp, (Sep 25, 2026)
By Tony Foley
A coalition of 44 state attorneys general have reached a settlement with Laboratory Corp. of America (Labcorp) in which the company has agreed to pay significant fines and implement measures to protect consumers after a 2019 data breach impacted millions of the company’s customers.
A press release yesterday from New York AG Letitia James (D.) explained that the data breach affected Labcorp’s debt collector, American Medical Collection Agency (AMCA), potentially exposing the data of 27.5 million people nationwide. As part of the settlement, Labcorp has agreed to pay the states nearly $2.3 million, to be distributed among the states in varying amounts.
In addition to the payment, Labcorp will institute the following remedial measures regarding its data security:
Improve its information security program and develop an incident response plan that includes internal reporting of vendor security breaches;
Minimize data-sharing with vendors while balancing needs of debt collectors to meet their legal obligations;
Expand its vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
Implement new requirements for debt collectors, enforcing cybersecurity standards, segmenting data in specified conditions, requiring debt collectors to perform assessments and audits, and providing for a right of termination for noncompliance; and
Hire a third-party assessor to perform an information security assessment with a focus on vendor risk management.
Joining AG James in the settlement were the following AGs, with links provided to states that have issued separate press releases on the settlement by press time: Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware , Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and the District of Columbia.
News: StateLegislation LitigationEnforcement DataSecurity DataBreach