Penalty Amount
$2,287,455
Consumers Affected
27,500,000
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
Labcorp will pay $2,287,455 to the states, improve its information security program, establish an incident response plan addressing vendor breaches, minimize data sharing with vendors, and expand vendor risk management. It must impose cybersecurity requirements on collection agencies through contracts, segment data, require assessments and audits, include termination rights for noncompliance, and retain an external assessor to evaluate information security and vendor risk management.
Review vendor and business associate agreements with collection agencies and other service providers for clear security standards, prompt notice of suspected or confirmed incidents, cooperation with incident response, data minimization and segregation obligations, and rights to assess, audit, and verify compliance. Include termination rights for security noncompliance and ensure customer-facing privacy and data-processing terms accurately describe what information is shared with vendors and why. Employee agreements are not directly implicated, but internal policies and responsibilities should support escalation of vendor breach notices.
Entity
Laboratory Corporation of America
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2026/la-fiscal-general-james-logra-23-millones-de-dolares-y-reformas-para-proteger
laboratory corporation of america assurance of voluntary com
https://ag.ny.gov/sites/default/files/settlements-agreements/laboratory-corporation-of-america-assurance-of-voluntary-compliance-2026.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Laboratory Corporation of America (Labcorp)"
"Labcorp pagará $2,287,455 dólares a los estados"
"tras una brecha de seguridad de datos ocurrida en 2019 que afectó a millones de clientes de la compañía."
"exponiendo potencialmente la información personal de más de 27.5 millones de personas en todo el país, incluidos 10.2 millones de pacientes de Labcorp"
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
$2.3M
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
$2.6M
New York and Connecticut reached a settlement with Boston Children’s Health Physicians and its IT security provider, XTIUM, after a 2024 breach exposed private information of approximately 825,000 New York residents and 62,871 Connecticut residents. The companies will pay $2.64 million and implement enhanced cybersecurity measures; additional penalties are conditional on violating the settlement.
New York Attorney General Letitia James joined 16 other attorneys general in urging Congress to pass proposed legislation addressing the federal government’s release of Jeffrey Epstein-related records. The press release says DOJ has not fully disclosed the records required by the original law and that personal information of at least 43 victims was exposed in released files; this is a legislative advocacy announcement, not an enforcement action imposing a penalty or remedy.
$1.9M
New York Attorney General Letitia James secured a settlement after an investigation found Dollar General stores routinely charged customers more than advertised or posted prices and issued confusing receipts. Dollar General must donate $1.875 million in food and personal items to Foodlink and implement pricing, receipt, training, and audit reforms.
New York Attorney General Letitia James released an updated guide warning voters that AI-generated election content and chatbots may provide misleading information. This is public guidance, not an enforcement action, and the release describes no penalty or privacy violation.