Penalty Amount
$2,287,455
Consumers Affected
27,500,000
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
Labcorp will pay $2,287,455 to the states, improve its information security program, establish an incident response plan addressing vendor breaches, minimize data sharing with vendors, and expand vendor risk management. It must impose cybersecurity requirements on collection agencies through contracts, segment data, require assessments and audits, include termination rights for noncompliance, and retain an external assessor to evaluate information security and vendor risk management.
Review vendor and business associate agreements with collection agencies and other service providers for clear security standards, prompt notice of suspected or confirmed incidents, cooperation with incident response, data minimization and segregation obligations, and rights to assess, audit, and verify compliance. Include termination rights for security noncompliance and ensure customer-facing privacy and data-processing terms accurately describe what information is shared with vendors and why. Employee agreements are not directly implicated, but internal policies and responsibilities should support escalation of vendor breach notices.
Entity
Laboratory Corporation of America
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2026/la-fiscal-general-james-logra-23-millones-de-dolares-y-reformas-para-proteger
laboratory corporation of america assurance of voluntary com
https://ag.ny.gov/sites/default/files/settlements-agreements/laboratory-corporation-of-america-assurance-of-voluntary-compliance-2026.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Laboratory Corporation of America (Labcorp)"
"Labcorp pagará $2,287,455 dólares a los estados"
"tras una brecha de seguridad de datos ocurrida en 2019 que afectó a millones de clientes de la compañía."
"exponiendo potencialmente la información personal de más de 27.5 millones de personas en todo el país, incluidos 10.2 millones de pacientes de Labcorp"
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
$2.3M
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
New York Attorney General Letitia James joined a coalition lawsuit challenging NHTSA’s rollback of federal fuel economy standards. The coalition alleges that the final rule violates federal law and asks the court to strike it down; the press release describes no privacy violations or monetary penalty.
$400.0M
New York Attorney General Letitia James and a coalition of 47 other attorneys general secured a $400 million settlement with Sandoz Inc. and Fougera Pharmaceuticals Inc. over an alleged scheme to coordinate generic drug prices and reduce competition. The settlement provides for consumer compensation and requires Sandoz to implement antitrust compliance reforms, including annual staff training and a Chief Compliance Officer.
New York Attorney General Letitia James joined eight other attorneys general in issuing a statement criticizing a DOJ judicial misconduct complaint against nearly all federal district court judges in Minnesota. The release concerns judicial independence, not a privacy enforcement action; it announces no penalty or privacy-related remedy.
$5.9M
New York Attorney General Letitia James sued Evolutions Festival LLC and 845 Vibrations LLC over the cancellation of the 2025 festival and their failure to refund ticket holders and vendors. The state alleges violations of laws governing advance ticket-sale funds and seeks restitution, civil penalties of $5,000 for each of 1,185 alleged violations, and an order requiring a $500,000 bond before the organizers can hold future cultural events in New York.