Connecticut Attorney General William Tong led a coalition of 44 attorneys general in a $2.3 million multistate settlement with Laboratory Corporation of America (LabCorp), resolving an investigation into the 2019 data breach at LabCorp's debt collector, American Medical Collection Agency.

The breach potentially exposed personal information of more than 27.5 million individuals nationwide, including 10.2 million LabCorp patients, of which 43,666 were Connecticut residents. Labcorp will pay $2,287,455 to the states, of which $81,296 is payable to Connecticut; the multistate coalition separately settled with American Medical Collection Agency in 2021 after its bankruptcy petition was dismissed, and Labcorp has agreed to a separate $35 million settlement in a related, ongoing class action lawsuit.

Tong said, "Labcorp outsourced their debt collection, and they shared sensitive personal information for millions of patients that was ultimately compromised. Labcorp was responsible for vetting and managing that vendor, and we're holding them accountable."

The settlement requires Labcorp to develop an incident response plan including internal reporting of vendor security events, minimize data sharing with vendors, and expand its vendor risk management program to include a dedicated team and compliance verification tools. It also adds specific requirements for debt collectors, including maintaining contract inventories, segmenting data often aggregated across multiple clients, and requiring debt collectors to perform assessments and audits with a right of termination for non-compliance.

Labcorp will also hire a Third-Party Assessor to perform an information security assessment focused on vendor risk management. The Attorneys General of Connecticut, Florida, Indiana, Illinois, Michigan, and Texas led the investigation, joined by dozens of other states and the District of Columbia.