(TNS) — Pennsylvania will receive more than $43,000 as part of a multistate settlement with the Laboratory Corporation of America over a 2019 data breach that potentially exposed the personal information of more than 218,000 state residents.
Attorney General Dave Sunday announced Thursday that Pennsylvania joined 44 other states in settling with Labcorp following an investigation into the breach at the company’s debt collector, Retrieval-Masters Creditors Bureau, which does business as American Medical Collection Agency.
The breach potentially exposed the personal information of 27.5 million people nationwide.
“This settlement will provide necessary protections to minimize the chances of such sensitive medical data being accessed again by bad actors,” Sunday said.
Under the settlement terms, Labcorp will pay more than $2.28 million to participating states. The agreement requires the company and its associated debt collectors to strengthen protections and improve response and notification plans for patient information.
While the breach occurred at AMCA, the compromised data belonged to Labcorp’s patients. The settlement establishes that companies remain responsible for data security even when working with third-party vendors.
The agreement imposes specific vendor management requirements on Labcorp. Labcorp must also hire a third-party assessor to evaluate its information security with a focus on vendor risk management.
This settlement adds to a previous multistate settlement with AMCA that included a $21 million payment suspended due to the company’s bankruptcy. Separately, Labcorp has agreed to a $35 million settlement in a related class-action lawsuit with other AMCA clients.
©2026 Advance Local Media LLC, Distributed by Tribune Content Agency, LLC.