Penalty Amount
$2,287,455
Consumers Affected
27,500,000
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
Labcorp must pay $2,287,455 to the states, strengthen its information security and vendor risk management programs, limit data sharing with vendors, impose and verify cybersecurity requirements for debt collectors through contracts, and hire a third-party assessor to evaluate information security with a focus on vendor risk management.
Review vendor and data-processing agreements, especially those with debt collectors and other vendors handling sensitive patient information. Confirm contracts limit data sharing to what is necessary, require appropriate cybersecurity controls and data segmentation, mandate prompt internal reporting of vendor security events, and provide for vendor assessments, audits, compliance verification, and termination for non-compliance. Review customer and business associate terms for clear allocation of security responsibilities, and ensure employee procedures support vendor oversight and incident escalation.
Entity
Laboratory Corporation of America
Industry
Healthcare"Sept. 24, 2026"
"settled with the Laboratory Corporation of America, also known as Labcorp"
"Labcorp will make a payment of $ 2,287,455 to the states."
"resolving a multistate investigation into the 2019 data breach at its debt collector American Medical Collection Agency."
"The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States"
"Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management."
$2.3M
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
$220.0M
General Motors agreed to a nationwide $220 million settlement over allegations that it sold drivers’ identifiable driving behavior and location data to data brokers, which then sold it to insurers. The settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
Colorado, the FTC, and a bipartisan group of state attorneys general sued Toast, alleging misleading claims about its subscription services and financial products, undisclosed fees, and obstacles to cancelling subscriptions. The coalition is asking the court for an injunction, monetary relief, civil penalties, and other relief; the press release does not report an imposed penalty.
Colorado joined a 21-attorney-general coalition suing to challenge a FinCEN rule that exempts nearly all businesses from Corporate Transparency Act ownership-reporting requirements, as well as plans to delete existing ownership records. The coalition alleges violations of the Corporate Transparency Act and Administrative Procedure Act and asks the court to invalidate the rule and require FinCEN to continue collecting and maintaining the records.
The Colorado Domestic Violence Fatality Review Board’s 2026 report describes domestic violence fatalities in Colorado and identifies trends and prevention opportunities. It is a public report, not a privacy enforcement action, and the release announces no penalty or remedy.