Wisconsin Department of Justice Announces $2.3 Million Multistate Settlement with Labcorp over American Medical Collection Agency Data Breach

On September 24, 2026, the Wisconsin Department of Justice announced a $2,287,455 multistate settlement with Laboratory Corporation of America (Labcorp), resolving a multistate investigation into the 2019 data breach at Labcorp's debt collector, Retrieval-Masters Creditors Bureau d/b/a American Medical Collection Agency (AMCA). The breach exposed the personal information of over 27.5 million individuals nationwide, including 10.2 million Labcorp patients; 16,615 Wisconsin residents were affected. A separate multistate coalition had previously settled with AMCA in 2021 following dismissal of AMCA's bankruptcy petition. The settlement proceeds from the theory that data security is a non-delegable duty: although Labcorp contracted with AMCA for debt collection services, the patient data at risk was Labcorp's, and Labcorp retained responsibility for its protection. Wisconsin's share of the settlement payment is $17,534, with the remaining balance distributed among 45 other states and the District of Columbia. The settlement imposes prospective vendor-management obligations on Labcorp. These include developing an incident response plan with internal reporting of vendor security events, minimizing data sharing with vendors consistent with debt collectors' legal obligations, and expanding Labcorp's vendor risk management program to include a dedicated team, vendor-evaluation tools, and compliance verification mechanisms. For debt collectors specifically, the settlement requires Labcorp to maintain contract inventories, enforce cybersecurity standards contractually, segment data that debt collectors aggregate across multiple clients, require debt collectors to perform assessments and audits, and include termination rights for non-compliance. Labcorp must also retain a third-party assessor to conduct an information security assessment focused on vendor risk management.