Labcorp Agrees to $35 Million Settlement Over 2018–2019 AMCA Data Breach
Laboratory Corporation of America Holdings (Labcorp) has agreed to a $35 million class action settlement to resolve claims stemming from a 2018–2019 cybersecurity incident involving its third-party billing vendor, American Medical Collection Agency (AMCA). The breach exposed the personal and health information of patients whose data Labcorp transmitted to AMCA between August 2018 and March 2019.
Eligibility and Compensation
Affected individuals may qualify for compensation if their data was compromised in the AMCA breach. Claimants can seek:
- Up to $5,000 for documented out-of-pocket losses, including expenses related to identity theft, medical fraud, credit monitoring, legal services, and up to 10 hours of remedial time at $25/hour.
- A $50 alternative cash payment for those without documented losses, though the final amount may adjust based on the number of valid claims.
- Two years of free medical monitoring via CyEx Medical Shield Pro.
Settlement Process and Deadlines
Claims can be filed online or by mail to the settlement administrator, Kroll Settlement Administration, by September 3, 2026. Required documentation varies by claim type, with receipts or records needed for out-of-pocket losses. Payments will be distributed via electronic transfer or mailed check after final court approval.
Key dates:
- Opt-out deadline: July 27, 2026
- Final fairness hearing: August 20, 2026
- Claim filing deadline: September 3, 2026
Settlement Fund Allocation
The $35 million fund will cover:
- Up to $11.67 million in attorneys’ fees
- $5,000 service awards for class representatives
- Administrative costs, medical monitoring expenses, and remaining payouts to eligible claimants
Background and Legal Context
The lawsuit alleged Labcorp failed to adequately protect patient data shared with AMCA, whose systems were breached. Labcorp denies wrongdoing, stating the settlement avoids litigation costs while providing relief to affected individuals. The breach, disclosed in 2019, also impacted other AMCA clients, including Quest Diagnostics, which settled separately for $195 million in 2022.
Payments will be issued after the court resolves any appeals and grants final approval.
Source: https://www.claimdepot.com/settlements/amca-data-breach-settlement-83395
Laboratory Corporation of America Holdings cybersecurity rating report: https://www.rankiteo.com/company/laboratory-corporation-of-america-holdings
Quest Diagnostics cybersecurity rating report: https://www.rankiteo.com/company/quest-diagnostics
"id": "LABQUE1780590997",
"linkid": "laboratory-corporation-of-america-holdings, quest-diagnostics",
"type": "Breach",
"date": "8/2018",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Patients whose data was '
'transmitted to AMCA between '
'August 2018 and March 2019',
'industry': 'Medical Diagnostics',
'name': 'Laboratory Corporation of America Holdings '
'(Labcorp)',
'type': 'Healthcare Services'},
{'industry': 'Medical Billing',
'name': 'American Medical Collection Agency (AMCA)',
'type': 'Third-Party Billing Vendor'}],
'customer_advisories': 'Compensation and medical monitoring offered to '
'affected individuals',
'data_breach': {'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal information',
'Health information']},
'date_publicly_disclosed': '2019',
'description': 'Laboratory Corporation of America Holdings (Labcorp) agreed '
'to a $35 million class action settlement to resolve claims '
'stemming from a 2018–2019 cybersecurity incident involving '
'its third-party billing vendor, American Medical Collection '
'Agency (AMCA). The breach exposed the personal and health '
'information of patients whose data Labcorp transmitted to '
'AMCA between August 2018 and March 2019.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Personal and health information of patients',
'financial_loss': '$35,000,000 (settlement amount)',
'identity_theft_risk': 'Yes',
'legal_liabilities': 'Class action lawsuit settlement'},
'investigation_status': 'Settled',
'post_incident_analysis': {'root_causes': 'Inadequate protection of patient '
'data shared with third-party '
'vendor (AMCA)'},
'references': [{'source': 'Settlement Announcement'}],
'regulatory_compliance': {'legal_actions': 'Class action lawsuit'},
'response': {'communication_strategy': 'Public disclosure and settlement '
'announcement'},
'title': 'Labcorp AMCA Data Breach Settlement',
'type': 'Data Breach'}