Labcorp has agreed to pay $2.3 million to resolve claims brought by 44 states over a 2019 data breach that exposed information on 10.2 million of its patients. Connecticut Attorney General William Tong, who led the group, announced the deal on Sept. 24. The money goes to the states, and the agreement offers no payments to patients.
A debt collector’s systems, and a lab’s decision to share the data
The breach did not happen on Labcorp’s own servers. It occurred at the American Medical Collection Agency (AMCA), a debt collector that worked for Labcorp, and exposed sensitive personal and health information belonging to more than 27.5 million people nationwide, according to the Connecticut attorney general’s announcement. Of that total, 10.2 million were Labcorp patients, and 43,666 of them lived in Connecticut.
The states’ theory is about the hand-off. In Tong’s words, “Labcorp outsourced their debt collection, and they shared sensitive personal information for millions of patients that was ultimately compromised.” The case treats a company’s choice of what to send a vendor, and how closely the vendor is watched, as part of the company’s own data-security duty.
Where the $2,287,455 goes
The exact payment is $2,287,455, which rounds to the $2.3 million in the headline. Connecticut’s share is $81,296, due within 30 days of the agreement’s effective date, and the release names Connecticut, Florida, Indiana, Illinois, Michigan and Texas as the leading states. It does not itemize the other states’ shares. The agreement text directs the funds to state enforcement and consumer protection work at each state’s discretion rather than to a patient fund.
Simple division shows the scale. Spread across the 10.2 million Labcorp patients, $2,287,455 would come to about 22 cents apiece, and that is before counting the other 17.3 million people (27.5 million minus 10.2 million) whose information the same breach exposed. The figure was never built as compensation for individuals. It is a state-enforcement payment, and the agreement leans on operating rules more than on the dollar amount.
The vendor rules Labcorp now has to follow
The lasting terms are requirements on how Labcorp handles outside companies. According to the Connecticut announcement, Labcorp must:
- develop incident response plans that include internal reporting of vendor security events;
- minimize the data it shares with vendors while still meeting legal obligations;
- expand vendor risk management with dedicated teams and evaluation tools;
- verify vendor compliance through assessments and audits; and
- hire a third-party assessor to evaluate its vendor risk management.
Debt collectors get their own set of requirements: an inventory of contracts, enforcement of cybersecurity standards and segmentation of the data that reaches them. The agreement text adds a chief information security officer, annual employee security training and a compliance assessment within 18 months, and its core obligations run for five years.
What patients receive from this settlement: nothing directly
Neither the press release nor the agreement provides refunds, checks or credit monitoring to individual patients. The document resolves the states’ civil claims and says it does not waive or limit any private right of action, so a patient’s separate legal options are left untouched.
A related private class action is the place where patient compensation is being handled. The Connecticut release describes a $35,000,000 settlement in that lawsuit and calls it still ongoing. Its terms, deadlines and eligibility are outside what the attorneys general announced, and readers should not assume that the state settlement makes anyone eligible for it.
Why a breach from 2019 is settling in 2026
The Connecticut release ties the settlement to a breach that dates to 2019, so the states’ case ran for years before the Sept. 24 announcement. The delay matters for households because a settlement announced this late says little about anything a patient should do today. It records what regulators concluded about the way a large lab handled outside vendors, and it sets the rules Labcorp is held to going forward, with an outside assessor checking the work.
The exposed information is described in the release only as sensitive personal information and protected health information of Labcorp patients. Neither the announcement nor the agreement itemizes it further, so specific data types such as Social Security numbers are not part of the states’ public description.
The same announcement on other states’ pages
The announcement showed up on several state attorney general sites the same day. New York’s press release index lists the Labcorp deal at $2.3 million on Sept. 24, and Pennsylvania’s news page carries it as a multistate AMCA action. For a household, the practical change is modest. A large lab must now handle vendors under audited rules, and any money for individuals would have to come through the separate class action, not this agreement.
The primary record is the Connecticut attorney general’s release of Sept. 24, 2026, which sets out the 44-state count, the $2,287,455 payment, the 10.2 million patients and the injunctive terms.
Personal listings on data broker sites are a separate exposure
Data brokers and people-search sites gather personal details such as addresses and phone numbers, and scammers can use that kind of information to pick and reach targets. Incogni asks data brokers and people-search sites to remove personal information, keeps re-sending the requests, and lets a subscriber see the status of each one. Less personal data on broker lists can mean fewer scam calls, texts and emails, which is a different problem from any single breach.
Send removal requests to data brokers with Incogni → We may earn a commission if you buy through this link.
This article was researched and drafted with AI assistance and checked against the cited primary sources.
