Attorney General Phil Weiser announces $2.3M national settlement with Labcorp over data breach

Attorney General Phil Weiser announces $2.3M national settlement with Labcorp over data breach

Sept. 24, 2026 (DENVER) - Attorney General Phil Weiser today announced that Colorado and a bipartisan coalition of attorneys general have settled with the Laboratory Corporation of America, also known as Labcorp, resolving a multistate investigation into the 2019 data breach at its debt collector American Medical Collection Agency.

The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients, of which 130,522 are Colorado residents. The multistate coalition settled with AMCA in 2021 after the company's bankruptcy petition was dismissed.

"The data involved in this breach was the sensitive data of Labcorp's patients. While companies can contract with vendors, they cannot shift data security legal obligations to a contractor or third party. It is critical that businesses properly vet their vendors and ensure that information shared with those vendors will be kept secure. We'll continue to enforce the laws to safeguard consumers' private information," Attorney General Weiser said.

Today's settlement provides strong requirements around vendor management, especially medical debt collection including:

• Developing certain aspects of the company's information security program, such as an incident response plan that includes internal reporting of vendor security events.
• Minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations.
• Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance.
• Adding specific requirements for debt collectors as a specialized subset of vendors, including maintaining contract inventories, enforcing cybersecurity standards through contract, segmenting data which is often aggregated by debt collectors for multiple clients, and requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance.
• Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management.

As part of the settlement, Labcorp will make a payment of $ 2,287,455 to the states. Colorado is expecting to receive $32,086 from the settlement. This settlement will supplement a multistate settlement with AMCA itself which included a $21 million suspended payment due to its bankruptcy. Separately Labcorp has agreed to a $35 million settlement in the related class action lawsuit, which is still ongoing with other AMCA client covered entities.

The attorneys general of Connecticut, Florida, Indiana, Illinois, Michigan, and Texas led the investigation. They are joined by the attorneys general Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Florida, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Utah, Vermont, Virginia, Washington, Wisconsin, and West Virginia.

Read the settlement with Labcorp (PDF).

###

Media Contact:
Lawrence Pacheco
Chief Communications Officer
(720) 508-6553 office
[email protected]