A massive breach at Labcorp’s debt collector exposed the personal data of more than 27.5 million people in 2019. Seven years later, a coalition of 44 states has secured a $2.3 million settlement and new safeguards to protect consumers’ sensitive medical and financial information. Between August 2018 and March 2019, hackers infiltrated the systems of American Medical Collection Agency (AMCA), a third-party debt collector for Labcorp. The breach compromised Social Security numbers, payment card details, and medical test information tied to millions of patients, including 420,000 New Yorkers.

Labcorp data breach: What happened

New York Attorney General Letitia James announced the settlement Wednesday, having joined a bipartisan coalition of 43 other state attorneys general to hold Labcorp accountable for the fallout of a 2019 breach tied to its debt collection vendor, American Medical Collection Agency (AMCA). The breach potentially exposed personal information belonging to over 27.5 million people across the country, including 10.2 million Labcorp patients specifically — 420,000 of whom lived in New York.

According to the settlement, a hacker accessed AMCA’s internal systems between August 1, 2018 and March 30, 2019, collecting customers’ personal information in the process. AMCA, based in Elmsford, New York, specialized in small-balance medical debt collection primarily on behalf of laboratories and testing facilities like Labcorp, which is headquartered in Burlington, North Carolina. Despite multiple warnings from banks processing AMCA’s payments about a possible breach, the company failed to detect the intrusion at the time. The exposed data included Social Security numbers, payment card information, and details about medical tests and diagnostic codes tied to roughly 420,000 New Yorkers alone.

What Labcorp has agreed to change

As part of the settlement, Labcorp is required to make comprehensive changes to how it manages data security, particularly around its relationships with outside vendors. The required reforms include strengthening its overall information security program and building an incident response plan that includes internal reporting requirements for vendor security breaches, minimizing how much data it shares with vendors while still allowing debt collectors to meet their legal obligations, and expanding its vendor risk management program to include a dedicated oversight team and stronger vendor compliance verification tools.

Labcorp will also be required to impose new cybersecurity standards on its debt collectors through contractual terms, segment data that’s often aggregated across multiple clients by debt collectors, mandate regular assessments and audits from those vendors, and retain the right to terminate vendor relationships over non-compliance. The company must additionally bring in a third-party assessor to evaluate its information security practices, with particular focus on vendor risk management.

Financially, Labcorp will pay $2,287,455 to the participating states, including $89,178 to New York specifically.

James emphasized that corporations bear a responsibility to protect customer data, particularly sensitive medical information, and framed the settlement as a direct consequence of Labcorp’s failure to adequately protect patients’ private health information.

This settlement builds on an earlier 2021 multistate settlement James’s office secured directly against AMCA, which included a $21 million payment that was ultimately suspended due to the company’s bankruptcy.

Join the community of 2M+ industry professionals.

Subscribe to Newsletter to get latest insights & analysis in your inbox.

All about ETCISO industry right on your smartphone!