Penalty Amount
$2,287,455
Consumers Affected
10,200,000
Laboratory Corporation of America Holdings agreed to pay $2,287,455 to participating states and strengthen its security and vendor-management practices following an investigation into the 2019 breach at its debt-collection vendor, AMCA. The breach potentially exposed information of more than 27.5 million people nationwide, including sensitive information belonging to approximately 10.2 million LabCorp patients.
LabCorp must pay $2,287,455 to participating states and strengthen its information-security and vendor-risk management programs. Requirements include minimizing data shared with vendors, expanding vendor assessments and verification, imposing cybersecurity and audit obligations on debt collectors through contracts, planning for vendor security incidents, and hiring an independent assessor to evaluate vendor-risk management.
Review vendor and business associate agreements, especially those with debt collectors and other service providers handling patient or other sensitive information. Confirm data-processing clauses limit shared data to what is necessary; require security controls, data segmentation, risk assessments, audits, and documented compliance verification; and mandate prompt reporting of vendor security events to support internal incident response. Add clear remediation and termination rights for security failures, and ensure customer-facing privacy notices and related agreements accurately describe vendor data sharing and safeguards.
Entity
Laboratory Corporation of America Holdings (LabCorp)
Industry
HealthcareOfficial Press Release
https://www.njoag.gov/new-jersey-joins-multistate-labcorp-settlement-over-2019-data-breach-impacting-more-than-400000-new-jerseyans/
2026 0924 Labcorp AVC NJ signed CP Filed
https://www.njoag.gov/wp-content/uploads/2026/09/2026-0924_Labcorp-AVC-NJ_signed_CP_Filed.pdf
New Jersey Attorney General Enforcement Page
https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/
"LabCorp will pay $2,287,455 to the participating states"
"LabCorp will pay $2,287,455 to the participating states, including $68,000 to New Jersey."
"entities covered by the Health Insurance Portability and Accountability Act"
"The breach occurred at Retrieval-Masters Creditors Bureau, doing business as American Medical Collection Agency (AMCA), a third-party vendor LabCorp used to collect medical debts."
"The compromised information included sensitive data belonging to approximately 10.2 million LabCorp patients, including 417,308 in New Jersey."
$10.0M
A March 2023 breach at the Perry Johnson companies exposed personal and protected health information belonging to more than 13.3 million people. The companies agreed to pay at least $300,000 in penalties, with an additional $9.7 million payable if they fail to meet the agreement, and to implement security, incident-response, and data-handling reforms.
$220.0M
A 36-attorney-general coalition resolved allegations that General Motors collected and sold identifiable driver behavior and location data to data brokers, which supplied it to insurers for use in assessing drivers and potentially raising premiums. The $220 million nationwide settlement requires affirmative express consent before collecting or disclosing driving and location data, limits data collection, and imposes privacy-program assessments and dealership oversight and training.
New Jersey, the FTC, and a coalition of 19 other states sued Dollar General, alleging that customers were repeatedly charged more at checkout than prices displayed on shelves, tags, and advertisements. The complaint alleges deceptive pricing practices and inadequate safeguards despite consumer complaints; the release does not describe a settlement, penalty, or other remedy imposed.
New Jersey joined a coalition of state attorneys general in filing a notice in Character Technologies, Inc.’s bankruptcy proceedings, raising concerns about the company’s safety and privacy practices and the sensitive conversations it holds, including those involving children and mental health. The states seek safeguards for consumers’ personal information in any sale or transfer of the company’s business or assets; the release does not report a fine or final finding of violations.
A multistate coalition co-led by New Jersey won a federal court order rejecting the Trump Administration’s decision not to request funding for the CFPB. The order struck down that decision and directed the Administration to follow the law and fund the agency; no monetary penalty or privacy violation is described.
New Jersey’s Attorney General and Division of Consumer Affairs alerted the public that three synthetic kratom-related compounds became illegal to possess or sell in the state under a temporary federal scheduling order. The release describes a controlled-substance alert, not a privacy enforcement action, and identifies no company, privacy violation, or monetary penalty.