Attorney General James Secures $2.3 Million and Reforms to Protect Consumers After Labcorp Data Breach

Massive Data Breach Exposed the Personal Information of Over 27.5 Million People Nationwide

New York Attorney General Letitia James today joined a bipartisan coalition of 43 other attorneys general in securing approximately $2.3 million and critical reforms to protect consumers from Laboratory Corporation of America (Labcorp) after a 2019 data breach impacted millions of Labcorp customers.  The data breach affected Labcorp’s debt collector, American Medical Collection Agency (AMCA), potentially exposing the personal information of over 27.5 million people nationwide, including 10.2 million Labcorp patients, 420,000 of which lived in New York.  As part of a settlement with Attorney General James and the coalition, Labcorp will overhaul its data security practices and develop a new system for sharing data with third party debt collectors to protect consumers.  Labcorp will also pay approximately $2.3 million to the states, including nearly $90,000 to New York.

“Corporations have a responsibility to protect their customers’ private data, especially sensitive medical information,” said Attorney General James.  “Millions of patients’ private health information was potentially exposed because of Labcorp’s failures to protect its customers.  As a result of our investigation, Labcorp will make critical changes to protect patients and prevent this kind of data breach from happening again.”

AMCA is based in Elmsford, New York, and specializes in small-balance medical debt collection, primarily for laboratories and medical testing facilities.  Labcorp, based in Burlington, North Carolina, provides laboratory testing for diagnostic services.  Between August 1, 2018, and March 30, 2019, a hacker accessed AMCA’s internal system and was able to collect customers’ personal information.  Despite numerous warnings from banks that processed their payments about a potential breach, AMCA failed to detect the intrusion.  The breach exposed the personal information – including Social Security numbers, payment card information, and names of medical tests and diagnostic codes – of approximately 420,00 New Yorkers.  As a result of Attorney General James and the coalition’s investigation, Labcorp must make comprehensive changes to its security policies to better protect its customers, especially when they interact with Labcorp’s vendors.  These changes include:

• Improving Labcorp’s information security program and developing an incident response plan that includes internal reporting of vendor security breaches;
• Minimizing data sharing with vendors while balancing certain needs of debt collectors to meet their legal obligations;
• Expanding the vendor risk management program to include requiring a dedicated team, employing tools to evaluate vendors, and verifying vendor compliance;
• Implementing new requirements for debt collectors, enforcing cybersecurity standards through contracts, segmenting data which is often aggregated by debt collectors for multiple clients, requiring debt collectors to perform assessments and audits, and including the right of termination for non-compliance; and
• Hiring a third-party assessor to perform an information security assessment with a focus on vendor risk management.

As part of the settlement, Labcorp will pay $2,287,455 to the states, including $89,178 to New York.  This settlement will supplement a multistate settlement with AMCA that Attorney General James and the coalition secured in 2021, which included a $21 million suspended payment due to the company’s bankruptcy.

Attorney General James is a leader in holding companies accountable for data breaches that put consumers at risk.  In July 2026, Attorney General James secured $18 million from 23 and Me for failing to protect customers’ genetic data.  In November 2025, Attorney General James secured $1.7 million from Illuminate Education after sensitive student data was stolen in a data breach.  In October 2025, Attorney General James announced her office secured $14.2 million from eight car insurance companies for failing to protect the private information of more than 825,000 New Yorkers.  In March 2025, Attorney General James secured $975,000 from Root, an auto insurer, and sued Allstate for failing to protect New Yorkers’ information.  In January 2025, Attorney General James secured $450,000 from three companies that distributed home security video cameras for failing to secure consumers’ private home security videos.

Joining Attorney General James in securing this settlement are the attorneys general of Alabama, Alaska, Arizona, Arkansas, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Virginia, Washington, Wisconsin, West Virginia, and the District of Columbia.

For New York, this matter was handled by Deputy Bureau Chief Clark Russell of the Bureau of Internet and Technology, under the supervision of Bureau Chief Kim Berger.  The Bureau of Internet and Technology is a part of the Division for Economic Justice, which is led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Meghan Faux.