Labcorp

Labcorp had roughly 10.25 million patients exposed (10,251,784 per HIPAA Journal's settlement coverage) in the same AMCA billing-vendor breach as Quest - two direct competitors, compromised simultaneously, through the same subcontractor neither patient population had ever heard of. Choosing Labcorp over Quest, or vice versa, provided no protection whatsoever. CareCentrix (about 467,600) and BioReference (423,000) were caught in the same incident. The structural lesson recurs across this tracker - see SITA in the Global Airlines tab and MOVEit in Life-Health-Dental - that in concentrated industries the meaningful security boundary is the shared vendor, and consumers cannot see it, evaluate it, or route around it.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.hipaajournal.com/labcorp-amca-data-breach-settlement/ — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected for individual patient agreements, separate from this specific AMCA-breach settlement.

Data sharing

SAME AMCA BREACH as Quest Diagnostics (see that row) — exposed personal/financial data of approximately 10.25 MILLION LabCorp patients specifically (10,251,784 per HIPAA Journal; earlier reports cited about 7.7 million). LabCorp reached a SEPARATE $35 MILLION SETTLEMENT (final approval hearing scheduled Aug. 20, 2026; claims deadline Sept. 3, 2026; final-approval outcome not confirmed as of Oct 2026) covering everyone whose data Labcorp transmitted to AMCA during the breach window — offering up to $5,000 for documented out-of-pocket losses from identity theft/fraud, credit monitoring, legal services, and related costs. This settlement resolves only the claims against Labcorp in the shared AMCA litigation; the status of claims against other defendants (including Quest) was not verified as of Oct 2026. Separately, on Sept. 24, 2026 a 44-state attorney-general coalition announced a ~$2.3 million ($2,287,455) settlement with Labcorp over the same AMCA incident.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.