Penalty Amount
$2,287,455
Consumers Affected
27,500,000
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
Labcorp must pay $2,287,455 to the states, strengthen its information security and vendor risk management programs, limit data sharing with vendors, impose and verify cybersecurity requirements for debt collectors through contracts, and hire a third-party assessor to evaluate information security with a focus on vendor risk management.
Review vendor and data-processing agreements, especially those with debt collectors and other vendors handling sensitive patient information. Confirm contracts limit data sharing to what is necessary, require appropriate cybersecurity controls and data segmentation, mandate prompt internal reporting of vendor security events, and provide for vendor assessments, audits, compliance verification, and termination for non-compliance. Review customer and business associate terms for clear allocation of security responsibilities, and ensure employee procedures support vendor oversight and incident escalation.
Entity
Laboratory Corporation of America
Industry
Healthcare"Sept. 24, 2026"
"settled with the Laboratory Corporation of America, also known as Labcorp"
"Labcorp will make a payment of $ 2,287,455 to the states."
"resolving a multistate investigation into the 2019 data breach at its debt collector American Medical Collection Agency."
"The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States"
"Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management."
$2.3M
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
Colorado joined a coalition of states and local governments in suing the National Highway Traffic Safety Administration over its rule weakening fuel economy standards for new passenger cars and light trucks. The coalition alleges the rule violates federal law; the press release does not report a penalty or a court ruling.
Colorado Attorney General Phil Weiser joined a multistate and local coalition challenging the EPA’s repeal of greenhouse gas limits for many coal- and gas-fired power plants. The coalition seeks to have the repeal struck down and the protections restored, and separately notified the EPA of its intent to sue over regulation of emissions from existing gas plants; no penalty or final court remedy is reported.
$469.0M
Colorado joined a 43-state-and-territory settlement resolving allegations that Sandoz and Fougera participated in a long-running conspiracy to inflate generic drug prices, reduce competition, and restrain trade. The companies agreed to pay approximately $469 million and implement reforms; the states are seeking court approval.
$35.0M
Colorado, the FTC, and a coalition of state attorneys general reached a settlement with Corteva over allegations that its post-patent loyalty program restricted distributors from selling competing generic pesticides. Corteva must end the challenged conduct and pay the states $35 million for fees and costs; the agreement is in effect for 10 years.