Attorney General Mike Hilgers Announces Multistate Settlement with Labcorp over the American Medical Collection Agency Data Breach

Posted

Thursday, September 24, 2026

Nebraska Attorney General Mike Hilgers today announced that Nebraska, as part of a coalition of 44 attorneys general, has settled with the Laboratory Corporation of America (“Labcorp”) resolving the multistate investigation into the 2019 data breach at Labcorp’s debt collector, Retrieval-Masters Creditors Bureau (AMCA). The AMCA breach potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients of which 9,777 are Nebraska residents. The multistate coalition settled with AMCA in 2021 after the company’s bankruptcy petition was dismissed.

While the data breach occurred at AMCA, the data involved was the sensitive data of Labcorp’s patients. While companies can contract with vendors freely and delegate authority, data security is a non-delegable duty. Vendor management remains one of the most challenging areas in cybersecurity, but it is critical that businesses properly vet their vendors and ensure that information shared with those vendors will be kept secure.

The settlement provides strong requirements around vendor management, especially medical debt collection including:

Developing certain aspects of the company’s information security program, such as an incident response plan that includes internal reporting of vendor security events;
Minimizing the sharing of data with vendors while balancing certain needs of debt collectors to meet their legal obligations;
Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
Adding specific requirements for debt collectors as a specialized subset of vendors, including maintaining contract inventories, enforcing cybersecurity standards through contract, segmenting data which is often aggregated by debt collectors for multiple clients, and requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance; and
Hiring a Third-Party Assessor to perform an information security assessment with a focus on vendor risk management.

As part of the settlement, Labcorp will make a payment of $ 2,287,455.00 to the states of which $16,661.00 is payable to Nebraska.

The Attorneys General of Connecticut, Florida, Indiana, Illinois, Michigan, and Texas led the investigation, assisted by the Executive Committee of the Attorneys General of Maryland, Massachusetts, New York, North Carolina, and Tennessee were joined by the Attorneys General of Alaska, Alabama, Arizona, Arkansas, Colorado, the District of Columbia, Delaware, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Maine, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Utah, Vermont, Virginia, Washington, Wisconsin, and West Virginia.

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.