AMCA Data Breach Settlement: Labcorp Class Action and State AG Deal

American Medical Collection Agency, operating as Retrieval-Masters Creditors Bureau, collected debts for laboratories and healthcare providers. Unauthorised access to its systems ran from August 2018 to March 2019 and was discovered on May 14, 2019, exposing protected health information and payment data of patients from multiple clients, according to HIPAA Journal.

HIPAA Journal reported that Labcorp agreed a $35 million class settlement covering 10,251,784 Labcorp patients. Benefits included reimbursement of documented losses up to $5,000 or an alternative cash payment of around $50, plus two years of medical identity monitoring. The objection and exclusion deadline was July 27, 2026, the final approval hearing was held on August 20, 2026, and the claim deadline was September 3, 2026. The two dates are often conflated; they are separate.

One search result described final approval on August 20, 2026, which conflicts with the September 3 fairness hearing date reported by HIPAA Journal. The status of final approval should be confirmed on the official settlement website.

Michigan's attorney general announced on September 29, 2026 a multistate settlement with Labcorp over the AMCA breach, reported at about $2.29 million paid to states rather than consumers. State attorneys general published the figure directly, including Michigan, New York, Pennsylvania and Colorado, with 44 participating states.

Breaches at vendors involve many clients, many patients, multiple jurisdictions, and complex questions of responsibility. Litigation and regulatory processes take years, so settlements arrive long after the incident, and companies remain accountable for vendors' failures.

Collection agencies and billing vendors receive patient identities, service details, and payment information. Healthcare organisations should limit what they send to collectors, require strong security controls contractually, audit vendors, and monitor for signs of compromise such as fraud reports from patients.

The AMCA access lasted months before discovery. Long dwell times expand impact. Vendors handling sensitive data need monitoring capable of detecting intrusions in days, not months.

Check the official settlement website for status and payment details, beware of scams impersonating settlement communications, and continue monitoring medical and financial statements for misuse.

Beyond the vendor's own collapse, client companies faced class actions, regulatory settlements, notification costs, and reputational harm. The AMCA case is often cited as an example of how vendor security failures transfer liability to clients.

Access August 2018 to March 2019; discovery May 14, 2019; class objection deadline July 27, 2026; final approval hearing August 20, 2026; claim deadline September 3, 2026; multistate settlement announced September 29, 2026.

Vendor breaches create long-tail liability. Limit what you share with vendors, require monitoring, and expect accountability for their failures.

AMCA collected debts for several laboratories and healthcare providers, so patients of other companies were also affected, and those companies faced their own litigation and notifications. HIPAA Journal's figure of more than 25 million people reflects all affected clients combined.

The breach's costs and loss of clients had severe consequences for the vendor itself, which is often cited as an example of how a single breach can threaten a smaller company's survival.

Collectors need enough to identify debtors and amounts owed. Diagnostic details and full medical histories rarely belong in collection files. Contracts and data feeds should limit fields to what collection requires.

Patient complaints about fraud, unusual payment activity, or reports from card networks can be early signs of a vendor compromise. Healthcare organisations should route such signals to security teams and ask vendors to investigate promptly.

If you filed a claim, the official settlement website and administrator are the authoritative sources for approval and payment status. Keep your claim number and avoid third-party sites that ask for personal details.

Breaches from years ago keep producing costs and obligations. Engineering leaders evaluating vendor security today are effectively deciding on settlements years from now.

Final approval was granted at the August 20, 2026 hearing. Payment timing is not the same as approval, so check the official settlement website for distribution dates.

Labcorp class: $35 million, about 10.25 million patients. Multistate AG: about $2.29 million to states, as reported. All AMCA clients: over 25 million people, per HIPAA Journal.