Forty four attorneys general, representing 43 states and the District of Columbia, announced a $2,287,455 settlement with Labcorp on September 24, 2026, over a breach that ran from August 2018 to March 2019. The intrusion happened at American Medical Collection Agency, a debt collector Labcorp used, and exposed Social Security numbers, payment card numbers, and the names of medical tests and diagnostic codes for roughly 10.2 million Labcorp patients out of more than 27.5 million people affected across AMCA's full client list. The settlement took effect October 1, 2026.
The dollar figure is not the part that matters for a product security or regulatory affairs team. The consent order requires Labcorp to name a qualified chief information security officer who reports to the CEO and board, run annual penetration testing against debt collection vendors, complete an independent assessment by a CISSP or equivalent within 18 months, and limit the patient data that reaches any vendor to the minimum necessary. Vendor contracts must now require adoption of a framework such as the NIST Cybersecurity Framework, data segmentation in multitenant environments, and remediation of vulnerabilities flagged by CISA or an equivalent agency on a defined timeline.
AMCA's breach was one of the largest vendor compromises in healthcare when it surfaced in 2019, touching not only Labcorp but Quest Diagnostics and other lab clients that routed billing data through the same system. AMCA itself filed for bankruptcy within months of disclosure. Seven years later, the settlement lands on the client that kept operating. AMCA no longer exists to be held accountable directly, which is the posture state attorneys general are increasingly taking toward companies that cannot show they vetted a vendor before handing it Social Security numbers.
Most of these obligations run five years, long enough for a vendor risk program built to pass a one time audit to either become real or fail publicly a second time. Any manufacturer or lab that routes PHI through a third party billing or collections vendor should treat the order as a preview of what a state attorney general settlement looks like once it reaches product security practices instead of just breach notification timelines.