Labcorp to Pay $35 Million Over 2018 AMCA Data Breach
The healthcare giant will compensate millions of patients after a cybersecurity attack on a former billing vendor exposed sensitive medical and financial data.
Labcorp has agreed to a $35 million settlement to resolve a class action lawsuit following a massive 2018 data breach at its former billing vendor. The agreement addresses the exposure of sensitive personal, financial, and medical information belonging to millions of patients.
The litigation, titled "In re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation," is currently pending in the District of New Jersey. Under the terms of the settlement, eligible individuals can claim a base cash payment of approximately $50 without providing proof of loss. Those who can provide documentation for out-of-pocket losses may be eligible for compensation up to $5,000, and the settlement also includes two years of medical monitoring for affected parties.
The AMCA Breach Context
The breach originated from a cybersecurity attack on the web payment portal of the American Medical Collection Agency (AMCA), a third-party debt collection and billing service used by Labcorp and several other healthcare organizations. The compromised data included names, dates of birth, Social Security numbers, and banking details. The vulnerability existed in AMCA's systems between August 1, 2018, and March 30, 2019, and the vendor filed for bankruptcy shortly after the breach became public knowledge.
Implications for Healthcare Data
This settlement underscores the significant legal and financial liabilities companies face when third-party vendors fail to secure sensitive patient data. It highlights a growing trend of "healthcare-adjacent" breaches, where the primary healthcare provider is held accountable for the security failures of its business associates. As healthcare providers increasingly rely on specialized vendors for billing and administrative tasks, the risk of systemic vulnerabilities in the supply chain becomes a critical corporate governance issue.
Next Steps for Claimants
Eligibility is limited to individuals whose personal information was accessed during the specified window between August 1, 2018, and March 30, 2019. The deadline for eligible individuals to file their claims for compensation is September 3, 2026. Patients should monitor official settlement communications to ensure they meet the filing requirements for the base payment or documented loss reimbursements.