Penalty Amount
$2,287,455
Consumers Affected
27,500,000
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
Labcorp must pay $2,287,455 to the states, strengthen its information security and vendor risk management programs, limit data sharing with vendors, impose and verify cybersecurity requirements for debt collectors through contracts, and hire a third-party assessor to evaluate information security with a focus on vendor risk management.
Review vendor and data-processing agreements, especially those with debt collectors and other vendors handling sensitive patient information. Confirm contracts limit data sharing to what is necessary, require appropriate cybersecurity controls and data segmentation, mandate prompt internal reporting of vendor security events, and provide for vendor assessments, audits, compliance verification, and termination for non-compliance. Review customer and business associate terms for clear allocation of security responsibilities, and ensure employee procedures support vendor oversight and incident escalation.
Entity
Laboratory Corporation of America
Industry
Healthcare"Sept. 24, 2026"
"settled with the Laboratory Corporation of America, also known as Labcorp"
"Labcorp will make a payment of $ 2,287,455 to the states."
"resolving a multistate investigation into the 2019 data breach at its debt collector American Medical Collection Agency."
"The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States"
"Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management."
$2.3M
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
Colorado Attorney General Phil Weiser joined a coalition of 12 attorneys general in settling a lawsuit against Paramount Skydance Corporation over its merger with Warner Bros. Discovery, which the states alleged would harm competition by lowering film output and raising prices. The settlement includes a five-year commitment to increase film output, a $1.5 billion investment in domestic production, a $47.5 million worker fund, and an independent monitor. This is an antitrust/competition enforcement action, not a privacy enforcement action, despite the extraction schema's privacy focus.
$30K
Colorado Attorney General Phil Weiser announced a settlement with Sares Regis Group, a Denver-metro property management company, after an investigation found it told prospective tenants that rental subsidies and housing vouchers were not accepted at its properties, in violation of the Colorado Anti-Discrimination Act and the Colorado Consumer Protection Act. Under the settlement, the company must adopt written source-of-income policies, train leasing employees, submit a compliance report to the AG's office, and refrain from misrepresenting its voucher acceptance, and it pays $30,000 to the Housing Rights Initiative. Note: this is a fair-housing enforcement action, not a privacy matter, so no privacy violation taxonomy categories apply.
$694.0M
Colorado and 40 other states entered into a settlement with Credit Acceptance Corporation (CAC), one of the nation's largest subprime auto lenders, resolving allegations that CAC originated car loans it knew or should have known consumers could not afford and that it failed to reasonably prevent dealers in its network from deceptively 'packing' Vehicle Service Contract and GAP add-on products into CAC-financed purchases. The settlement provides $694 million in cash and debt relief to consumers plus an additional $15 million to the attorneys general, and imposes injunctive reforms including loan 'off ramps,' enhanced pre-purchase and pre-loan disclosures, dealer monitoring, and a seven-year price cap at 109% of retail book value. Note: this is a consumer-lending enforcement action, not a data privacy matter; the 'dark_patterns' category is the closest available fit for the deceptive add-on sales allegations.
$150K
Colorado Attorney General Phil Weiser announced a settlement with Corporate Certificates, LLC and FL UCC Statement Service, LLC resolving allegations that the companies mailed marketing materials to Colorado businesses designed to look like official government invoices, without the statutorily required disclaimers and with purported deadlines implying a legal duty. Under the stipulated consent judgment, the companies will pay $150,000 in refunds and fees and permanently cease all operations in Colorado. The companies had ignored prior warning notices and stopped operating in Colorado in August 2025 after the AG obtained a preliminary injunction.