BURLINGTON – Labcorp agreed to pay $2,287,455 in a multistate settlement and adopt new vendor-security controls stemming from a 2019 breach at its former debt collector.
The Sept. 24 agreement with a coalition of 44 attorneys general resolves a multistate investigation into the breach at Retrieval-Masters Creditors Bureau, which operated as American Medical Collection Agency. The Delaware Department of Justice said the incident potentially exposed information belonging to more than 27.5 million people nationwide, including 10.2 million Labcorp patients.
The settlement requires Labcorp to strengthen its incident-response planning for vendor security events, minimize data shared with vendors and expand its vendor-risk program. The company must dedicate a team to vendor oversight, use tools to evaluate vendors and verify compliance, according to the state.
Labcorp also must impose additional requirements on debt collectors, including contract inventories, cybersecurity standards, data segmentation, assessments and audits, and termination rights for noncompliance. A third-party assessor will evaluate Labcorp’s information-security program with a focus on vendor risk management.
The Delaware record gives the payment as exactly $2,287,455. KYW Newsradio independently reported the settlement and the company’s commitments to reduce vendor data sharing and strengthen requirements for debt collectors.
The settlement addresses the 2019 vendor breach rather than a newly disclosed incident. Labcorp’s corporate facts page lists its headquarters in Burlington, about 71,000 employees and $14 billion in fiscal 2025 revenue.