Nebraska AG: Multistate Labcorp AMCA Data Breach Settlement Reached

• Labcorp has reached a multistate settlement resolving an investigation into a 2019 data breach at its debt collector, Retrieval-Master, also known as the American Medical Collection Agency (AMCA).
• The settlement was announced by Nebraska Attorney General Mike Hilgers on Thursday, September 24, 2026, as part of a coalition of 44 state attorneys general.
• The investigation focused on the security incident that occurred at Labcorp’s third-party vendor, highlighting the enforcement risks associated with vendor data security.
• This resolution underscores the increasing scrutiny companies face regarding healthcare data privacy and the importance of robust data security vendor management.

This comprehensive settlement marks the conclusion of a broad inquiry initiated by a coalition of state attorneys general.

A significant multistate investigation into a 2019 data breach has culminated in a settlement involving the Laboratory Corporation of America, commonly known as Labcorp. The resolution addresses a security incident that originated with Labcorp’s debt collector, Retrieval-Master, an entity widely recognized as the American Medical Collection Agency (AMCA) in connection with this breach. This comprehensive settlement marks the conclusion of a broad inquiry initiated by a coalition of state attorneys general.

The 2019 security lapse at Retrieval-Master, operating as AMCA, prompted concerns across numerous jurisdictions due to the sensitive nature of the information potentially compromised. The subsequent multistate investigation sought to understand the circumstances surrounding the breach and its implications for consumer data privacy. This collective action by state legal authorities underscores the serious regulatory scrutiny companies face when sensitive personal data is exposed, particularly through third-party vendors.

The formal announcement of this Multistate Labcorp AMCA data breach settlement was made by Nebraska Attorney General Mike Hilgers on Thursday, September 24, 2026. This public disclosure confirmed that Nebraska was among a large group of states participating in the resolution. The settlement represents a coordinated effort by state legal offices to hold companies accountable for data security failures, even when those failures occur within their vendor ecosystem.

The agreement reached is a direct outcome of the extensive multistate investigation into the 2019 data breach. The Laboratory Corporation of America settlement involves Labcorp directly, despite the breach occurring at its debt collection vendor. This highlights the principle that companies often bear responsibility for the security practices of their third-party service providers, especially when handling sensitive consumer information.

The coalition spearheading this action comprised 44 state attorneys general, demonstrating a widespread commitment to healthcare data privacy enforcement. Nebraska Attorney General Mike Hilgers played a role in announcing the outcome, signifying the state's participation in this collective legal effort. The involvement of such a large number of states underscores the national scope of the data breach's impact and the unified front presented by state regulators.

This resolution serves as a clear example of how state attorneys general are leveraging their consumer protection authority to address significant data security incidents. The focus of the investigation and subsequent settlement was to resolve the issues stemming from the 2019 breach, ensuring accountability and potentially setting precedents for future data security vendor management expectations within the healthcare sector and beyond.

The Multistate Labcorp AMCA data breach settlement carries significant implications for businesses, particularly those operating in the healthcare industry and relying on external vendors. It reinforces the critical importance of robust data security vendor management and the potential liabilities that can arise from third-party security failures. Companies must recognize that outsourcing functions does not absolve them of responsibility for protecting consumer data, especially sensitive health information.

This outcome signals to legal and compliance professionals that proactive review of data security frameworks and comprehensive vendor oversight are not merely best practices but essential safeguards against substantial enforcement risks. The involvement of 44 attorneys general in this AG consumer protection settlement underscores the regulatory environment's increasing focus on data privacy and security. The Nebraska AG Labcorp settlement, as part of this broader action, exemplifies the commitment of state legal offices to pursue accountability for data breaches.

Ultimately, this case highlights the significant financial and reputational risks associated with inadequate data protection, particularly when sensitive health data is involved. It serves as a stark reminder that companies must implement stringent security protocols and conduct thorough due diligence on all third-party partners to prevent similar incidents and avoid costly and complex multistate regulatory actions.

This multistate settlement highlights the significant enforcement risks companies face for data breaches, especially those involving third-party vendors and sensitive health information. Legal and compliance professionals should proactively review their data security frameworks and vendor oversight to prevent similar liabilities and regulatory actions.

Source: Original reporting via the Nebraska Attorney General's Office