Loading story…
A bipartisan coalition of 44 U.S. state attorneys general has settled litigation with Labcorp over alleged cybersecurity and vendor-oversight failures tied to the 2019 breach of debt-collection provider American Medical Collection Agency (AMCA). The incident exposed data relating to 10.2 million Labcorp customers and was part of a broader AMCA compromise affecting 27.5 million people nationwide.
Labcorp will pay $2.3 million and implement extensive data-security reforms. The settlement requires strengthened third-party risk controls, including vendor incident-response planning, cybersecurity provisions in vendor contracts, compliance audits, independent security assessments, reduced data sharing, and segregation of sensitive data.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
A bipartisan coalition of 44 U.S. state attorneys general settled litigation with Labcorp over alleged inadequate oversight of AMCA's data-security practices. Labcorp agreed to pay a $2.3 million fine and implement vendor-security and information-security reforms, including vendor incident-response planning, compliance audits, independent assessments, and data segregation.
A court sided with the coalition of state attorneys general in litigation against AMCA and ordered the company to pay a $21 million fine. The penalty was suspended after AMCA went bankrupt.
A 2019 data breach involving Labcorp's debt-collection vendor, American Medical Collection Agency (AMCA), affected 10.2 million Labcorp customers. The broader AMCA incident affected 27.5 million people nationwide.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Labcorp agreed to pay **$35 million** to settle class-action litigation tied to the 2018–2019 cyberattack on its former billing vendor, American Medical Collections Agency, operated by Retrieval-Masters Credit Bureau. Labcorp said the incident affected nearly **10.3 million patients** whose personal information had been sent to AMCA and was present in the vendor’s systems between August 2018 and March 2019. Exposed data included **Social Security numbers**, payment card information, and in some cases medical test names and diagnostic codes. Under the proposed settlement, eligible class members can seek reimbursement of documented losses of up to **$5,000**, an estimated pro-rata cash payment of about **$50**, and **two years of medical and healthcare information monitoring**. Labcorp denied wrongdoing, and a final fairness hearing is scheduled in New Jersey federal court on Aug. 20. The AMCA breach affected roughly **24 million people** across dozens of clients, also hit Quest Diagnostics and BioReference Laboratories, contributed to AMCA’s 2019 bankruptcy, and previously led to a 2021 multistate settlement with **41 state attorneys general**.
Jun 29, 2026
An Australian federal court imposed a landmark AU$5.8 million fine on Australian Clinical Labs (ACL) for its mishandling of a significant data breach at its Medlab Pathology unit. The penalty, equivalent to approximately $3.8 million USD, marks the first time Australia has issued a civil monetary fine under the Privacy Act of 1988 for a data privacy violation. The case originated from a February 2022 cyberattack by the Quantum Group, a cybercriminal gang, which targeted Medlab Pathology shortly after ACL acquired the company in December 2021. During the attack, Quantum Group executed both data encryption and exfiltration, compromising sensitive information belonging to 223,000 patients. In the immediate aftermath, ACL publicly stated that no data had been exfiltrated and that the incident did not constitute a notifiable data breach under Australian law. However, these assertions were contradicted by an alert from the Australian Cyber Security Centre on March 25, 2022, which indicated that intelligence from a trusted third party suggested Medlab had indeed been the victim of a ransomware incident. The court found that ACL failed to adequately secure patient data both before and after the breach, highlighting deficiencies in cybersecurity controls and incident response. The ruling emphasized that ACL's delayed and inaccurate breach notification further exacerbated the impact on affected individuals. The fine serves as a precedent for future enforcement of privacy regulations in Australia, signaling a stricter approach to corporate accountability in the healthcare sector. The breach exposed a range of personal and health information, raising concerns about the potential for identity theft and other forms of misuse. Regulatory authorities underscored the importance of timely and transparent communication with both regulators and affected patients in the wake of such incidents. The case also illustrates the growing legal and financial risks faced by organizations that fail to comply with data protection obligations. The court's decision is expected to influence how other Australian companies approach cybersecurity and privacy compliance. The incident has prompted calls for enhanced security measures and more robust breach notification processes across the healthcare industry. ACL's experience demonstrates the reputational and operational consequences of inadequate cyber risk management. The fine is intended not only as punishment but also as a deterrent to encourage better data stewardship. The outcome of this case is likely to shape future regulatory actions and industry practices regarding data privacy in Australia.
Jun 29, 2026
A coalition of 42 U.S. state attorneys general reached an **$18 million settlement** with 23andMe over cybersecurity failures tied to the company’s 2023 breach, which exposed genetic and other personal information belonging to **6.9 million people**. Authorities said the company failed to defend against credential-based attacks, lacked adequate intrusion prevention, did not properly log and monitor for intrusions, failed to remediate known vulnerabilities, and did not investigate unusual login activity. The settlement also imposes new security and governance requirements on the **23andMe Research Institute**, which acquired the company’s assets, including genetic data, after its 2025 bankruptcy, while preserving customers’ rights to delete personal data and destroy genetic samples. In a related bankruptcy ruling, a U.S. judge held that **California cannot seek monetary damages** from the company formerly known as 23andMe because its Chapter 11 reorganization plan bars those claims, though the state may still pursue non-monetary remedies. The court said California had participated in the bankruptcy case and had an earlier opportunity to challenge jurisdiction, requiring the state to amend or dismiss its lawsuit to remove claims for civil fines. The bankruptcy process also created a customer claims fund, and the court has authorized **$46.75 million** in total payouts connected to the breach.
Aug 11, 2026