Penalty Amount
$2,287,455
Consumers Affected
27,500,000
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
Labcorp must pay $2,287,455 to the states, strengthen its information security and vendor risk management programs, limit data sharing with vendors, impose and verify cybersecurity requirements for debt collectors through contracts, and hire a third-party assessor to evaluate information security with a focus on vendor risk management.
Review vendor and data-processing agreements, especially those with debt collectors and other vendors handling sensitive patient information. Confirm contracts limit data sharing to what is necessary, require appropriate cybersecurity controls and data segmentation, mandate prompt internal reporting of vendor security events, and provide for vendor assessments, audits, compliance verification, and termination for non-compliance. Review customer and business associate terms for clear allocation of security responsibilities, and ensure employee procedures support vendor oversight and incident escalation.
Entity
Laboratory Corporation of America
Industry
Healthcare"Sept. 24, 2026"
"settled with the Laboratory Corporation of America, also known as Labcorp"
"Labcorp will make a payment of $ 2,287,455 to the states."
"resolving a multistate investigation into the 2019 data breach at its debt collector American Medical Collection Agency."
"The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States"
"Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management."
$2.3M
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
Colorado Attorney General Phil Weiser led a multistate coalition in filing a notice in Character Technologies, Inc.’s bankruptcy, citing concerns about the company’s safety and privacy practices and sensitive chatbot conversations involving children and adults. The filing seeks protections in any sale or transfer of the company’s business or assets; no penalty or final remedy is reported.
Colorado Attorney General Phil Weiser issued a public advisory explaining that e-bikes must meet statutory class requirements and that retailers must clearly disclose what they are selling. The advisory warns that marketing a higher-powered electric vehicle as an e-bike without required disclosures may violate state consumer protection law; it announces no penalty or binding remedy.
Colorado Attorney General Phil Weiser and a multistate coalition sued the U.S. Department of Labor over its termination of grants for unemployment insurance system improvements. The states allege the terminations breached their grant agreements and seek money damages; the release does not describe a privacy violation or an imposed penalty.
Colorado Attorney General Phil Weiser joined a multistate coalition in a comment letter opposing HHS’s proposed cuts to Head Start standards. The letter argues the changes could reduce protections and services for children and families; it is an advocacy action, not an enforcement action imposing a penalty or remedy.