Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings

A bipartisan coalition of 44 state attorneys general settled a lawsuit with Labcorp requiring a $2.3 million fine and extensive data security reforms after a 2019 breach at vendor AMCA exposed medical information for millions (10.2M directly through Labcorp, 27.5M overall). The settlement mandates improved vendor controls, contractual cybersecurity requirements, regular audits, an independent security assessor, data siloing, and a vendor-focused risk-management program to prevent future incidents.