Labcorp to pay $2.3 million over patient data breach in 44-state settlement
The settlement resolves an investigation into a 2019 breach at Labcorp's debt collector, which attorneys general said exposed data on more than 27.5 million people nationwide, including 43,666 Connecticut residents.
Laboratory Corporation of America will pay about $2.3 million to settle an investigation by 44 state attorneys general into a 2019 data breach at the company's medical debt collector, Connecticut Attorney General William Tong said Thursday.
The breach happened at Retrieval-Masters Creditors Bureau, which did business as the American Medical Collection Agency, but the information taken belonged to Labcorp patients, the attorney general's office said. The breach potentially exposed personal information on more than 27.5 million people across the country, including 10.2 million Labcorp patients, 43,666 of them Connecticut residents, according to the office.
"Labcorp outsourced their debt collection, and they shared sensitive personal information for millions of patients that was ultimately compromised," Tong said. "Labcorp was responsible for vetting and managing that vendor, and we're holding them accountable."
Under the agreement, Labcorp will pay $2,287,455 to the states, with $81,296 going to Connecticut. The company also agreed to strengthen its information security program, including an incident response plan covering vendor security problems, limits on the data it shares with vendors, an expanded vendor risk management program with a dedicated team, cybersecurity requirements written into debt collector contracts, and an outside assessor to review its vendor risk practices.
The states reached a separate settlement with the collection agency itself in 2021, after the company's bankruptcy petition was dismissed, that included a suspended $21 million payment, the attorney general's office said. Labcorp has also agreed to a $35 million settlement in a related class action.
Connecticut, Florida, Indiana, Illinois, Michigan and Texas led the investigation. Maine, Massachusetts, New Hampshire, Rhode Island and Vermont were among the states joining the settlement.
This brief was drafted by AI from a public agency press release and published by The New England Signal. Why we use AI for stories like this one.