Penalty Amount
$2,287,455
Consumers Affected
27,500,000
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
Labcorp will pay $2,287,455 to the states, improve its information security program, establish an incident response plan addressing vendor breaches, minimize data sharing with vendors, and expand vendor risk management. It must impose cybersecurity requirements on collection agencies through contracts, segment data, require assessments and audits, include termination rights for noncompliance, and retain an external assessor to evaluate information security and vendor risk management.
Review vendor and business associate agreements with collection agencies and other service providers for clear security standards, prompt notice of suspected or confirmed incidents, cooperation with incident response, data minimization and segregation obligations, and rights to assess, audit, and verify compliance. Include termination rights for security noncompliance and ensure customer-facing privacy and data-processing terms accurately describe what information is shared with vendors and why. Employee agreements are not directly implicated, but internal policies and responsibilities should support escalation of vendor breach notices.
Entity
Laboratory Corporation of America
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2026/la-fiscal-general-james-logra-23-millones-de-dolares-y-reformas-para-proteger
laboratory corporation of america assurance of voluntary com
https://ag.ny.gov/sites/default/files/settlements-agreements/laboratory-corporation-of-america-assurance-of-voluntary-compliance-2026.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Laboratory Corporation of America (Labcorp)"
"Labcorp pagará $2,287,455 dólares a los estados"
"tras una brecha de seguridad de datos ocurrida en 2019 que afectó a millones de clientes de la compañía."
"exponiendo potencialmente la información personal de más de 27.5 millones de personas en todo el país, incluidos 10.2 millones de pacientes de Labcorp"
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
$2.3M
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
The New York Attorney General issued a consumer alert and online guide about scams targeting service members and veterans, including phishing and credit-monitoring scams that may misuse personal information. The release provides steps for protecting information and reporting suspected scams; it does not announce an enforcement action or monetary penalty.
$10.0M
A March 2023 breach exposed personal and protected health information associated with more than 13.3 million people after attackers accessed company systems using an employee’s credentials. The Perry Johnson companies agreed to pay at least $300,000, with an additional $9.7 million in penalties due if they fail to meet the agreement, and to implement security, incident response, and health-data handling reforms.
New York Attorney General James and Governor Hochul announced guidance advising county executives and sheriffs that they must end agreements to house or detain people for federal civil immigration violations by November 25, 2026. The Local Cops, Local Crimes Act makes those agreements void and unenforceable after the deadline; no monetary penalty or specific enforcement order is announced.
New York Attorney General Letitia James issued a consumer alert warning federal student loan borrowers that consolidating loans after changes under the One Big Beautiful Bill Act may limit repayment options and forgiveness eligibility. This is consumer guidance, not a privacy enforcement action; the release announces no fine or enforcement remedy.