A bipartisan coalition of 44 US state attorneys general has settled a lawsuit with Labcorp over cybersecurity failings linked to the 2019 breach at American Medical Collection Agency (AMCA). Labcorp will pay a $2.3 million fine and implement extensive data-security reforms. The breach affected 10.2 million Labcorp customers, while the wider AMCA incident affected 27.5 million people nationwide.
The attorneys general argued that Labcorp should have done more to oversee AMCA, a debt collector it used. Under the settlement, Labcorp must create an incident-response plan for vendor security failures, restrict the amount of data it shares with suppliers and establish a risk-management team to monitor vendors’ compliance with security requirements. It must also include cybersecurity obligations in vendor contracts and require data-collection partners to provide regular audits documenting their compliance.