Loading story…
Labcorp agreed to pay $35 million to settle class-action litigation tied to the 2018–2019 cyberattack on its former billing vendor, American Medical Collections Agency, operated by Retrieval-Masters Credit Bureau. Labcorp said the incident affected nearly 10.3 million patients whose personal information had been sent to AMCA and was present in the vendor’s systems between August 2018 and March 2019. Exposed data included Social Security numbers, payment card information, and in some cases medical test names and diagnostic codes.
Under the proposed settlement, eligible class members can seek reimbursement of documented losses of up to $5,000, an estimated pro-rata cash payment of about $50, and two years of medical and healthcare information monitoring. Labcorp denied wrongdoing, and a final fairness hearing is scheduled in New Jersey federal court on Aug. 20. The AMCA breach affected roughly 24 million people across dozens of clients, also hit Quest Diagnostics and BioReference Laboratories, contributed to AMCA’s 2019 bankruptcy, and previously led to a 2021 multistate settlement with 41 state attorneys general.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
A final fairness hearing on the proposed Labcorp settlement is scheduled for Aug. 20 in New Jersey federal court.
Labcorp agreed to pay $35 million to settle class action litigation tied to the AMCA breach affecting nearly 10.3 million patients. The proposed settlement offers reimbursement of documented losses up to $5,000 or an estimated pro-rata cash payment of about $50, plus two years of medical and healthcare information monitoring.
In 2021, a coalition of 41 state attorneys general reached a $21 million settlement with AMCA over the breach. The fines were suspended because of the company's bankruptcy.
The AMCA breach contributed to American Medical Collections Agency's bankruptcy in 2019.
Labcorp said personal information it sent to Retrieval-Masters Credit Bureau, operating as AMCA, was present in AMCA systems during a cyber incident between August 2018 and March 2019. The incident was part of a broader AMCA breach affecting dozens of clients and exposing sensitive data including Social Security numbers and payment card information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceamcadatabreachsettlement.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Marlboro-Chesterfield Pathology has agreed to settle a class action lawsuit tied to a January 2025 ransomware attack attributed to the **SafePay** group, after attackers gained unauthorized access to its network and obtained files containing sensitive patient information. The pathology provider reported to the U.S. Department of Health and Human Services Office for Civil Rights that **235,911 individuals** were affected, with compromised data including names, dates of birth, Social Security numbers, and protected health information. The proposed settlement, which received preliminary court approval, provides reimbursement of documented fraud- or identity-theft-related losses of up to **$1,000** per class member, a **$10** alternative cash payment for certain people whose Social Security numbers were exposed, and one year of credit monitoring and identity theft protection. Marlboro-Chesterfield Pathology denied wrongdoing and liability, and no ransom payment details were disclosed, while a final fairness hearing is scheduled for **October 12, 2026**.
Jul 16, 2026
An Australian federal court imposed a landmark AU$5.8 million fine on Australian Clinical Labs (ACL) for its mishandling of a significant data breach at its Medlab Pathology unit. The penalty, equivalent to approximately $3.8 million USD, marks the first time Australia has issued a civil monetary fine under the Privacy Act of 1988 for a data privacy violation. The case originated from a February 2022 cyberattack by the Quantum Group, a cybercriminal gang, which targeted Medlab Pathology shortly after ACL acquired the company in December 2021. During the attack, Quantum Group executed both data encryption and exfiltration, compromising sensitive information belonging to 223,000 patients. In the immediate aftermath, ACL publicly stated that no data had been exfiltrated and that the incident did not constitute a notifiable data breach under Australian law. However, these assertions were contradicted by an alert from the Australian Cyber Security Centre on March 25, 2022, which indicated that intelligence from a trusted third party suggested Medlab had indeed been the victim of a ransomware incident. The court found that ACL failed to adequately secure patient data both before and after the breach, highlighting deficiencies in cybersecurity controls and incident response. The ruling emphasized that ACL's delayed and inaccurate breach notification further exacerbated the impact on affected individuals. The fine serves as a precedent for future enforcement of privacy regulations in Australia, signaling a stricter approach to corporate accountability in the healthcare sector. The breach exposed a range of personal and health information, raising concerns about the potential for identity theft and other forms of misuse. Regulatory authorities underscored the importance of timely and transparent communication with both regulators and affected patients in the wake of such incidents. The case also illustrates the growing legal and financial risks faced by organizations that fail to comply with data protection obligations. The court's decision is expected to influence how other Australian companies approach cybersecurity and privacy compliance. The incident has prompted calls for enhanced security measures and more robust breach notification processes across the healthcare industry. ACL's experience demonstrates the reputational and operational consequences of inadequate cyber risk management. The fine is intended not only as punishment but also as a deterrent to encourage better data stewardship. The outcome of this case is likely to shape future regulatory actions and industry practices regarding data privacy in Australia.
Jun 29, 2026
ALN Medical Management and Octapharma Plasma have agreed to pay a combined total of $6.5 million to settle class action lawsuits stemming from separate cyberattacks that occurred in 2024. ALN Medical Management, a Nebraska-based revenue cycle management firm acquired by Health Prime in 2023, experienced a significant cyber incident in March 2024. Initially, ALN reported the breach to U.S. federal regulators as affecting only 501 individuals, but subsequent investigations revealed the true impact was much larger, with court documents indicating approximately 1.8 million people were affected. The company has agreed to pay $4 million to resolve the proposed class action lawsuit related to this breach. The breach was reported as a HIPAA data breach, highlighting the exposure of sensitive healthcare information. The settlement is pending a preliminary court hearing, with the date yet to be determined. Octapharma Plasma, a Swiss-based pharmaceutical manufacturer with blood plasma collection centers in the United States, was also targeted in a separate cyberattack in April 2024. In response to the resulting class action litigation, Octapharma Plasma has agreed to pay $2.55 million to settle claims from affected individuals. Both companies are among the latest in the healthcare sector to face multimillion dollar settlements following major hacking incidents. The breaches underscore the ongoing risks to patient data and the significant financial and reputational consequences for healthcare organizations. The settlements reflect the growing trend of legal action and regulatory scrutiny following large-scale data breaches in the healthcare industry. Both incidents involved the compromise of sensitive personal and health information, leading to widespread notification and remediation efforts. The lawsuits alleged that the companies failed to adequately protect patient data, resulting in unauthorized access and potential misuse of information. The settlements are intended to compensate affected individuals and cover costs related to credit monitoring and identity protection. These cases highlight the importance of robust cybersecurity measures and incident response planning for healthcare organizations. The financial impact of the settlements serves as a warning to other entities in the sector about the potential costs of inadequate data protection. The incidents have prompted calls for increased investment in cybersecurity and compliance with data privacy regulations. Both ALN Medical Management and Octapharma Plasma have taken steps to address the vulnerabilities exploited in the attacks and to enhance their security postures moving forward. The legal outcomes may influence future litigation and regulatory actions in the healthcare industry regarding data breaches.
Jul 12, 2026