American Medical Collection Agency Data Breach: Labcorp Settled, Quest Still in Court
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
The American Medical Collection Agency data breach is the 2019 hack of a debt collector that Quest Diagnostics, Labcorp and other labs used. As of October 2026 there are two different answers. Labcorp patients: a $35 million settlement exists, but its claim deadline was September 3, 2026, and it has passed. Quest and Optum360 patients: that part of the case is still being litigated, with no settlement and no claim form.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What Happened at AMCA
American Medical Collection Agency (AMCA), the trade name of Retrieval-Masters Creditors Bureau, Inc., was a small-balance medical debt collector based in Elmsford, New York, working mainly for laboratories. Labs sent it unpaid patient bills. According to Quest's and Labcorp's SEC filings, an unauthorized user had access to AMCA's system from August 1, 2018 to March 30, 2019.
AMCA's system held names, addresses, dates of birth, payment card and bank account numbers, health insurance details and, for some people, Social Security numbers. Lab test results were not on it. The New York Attorney General says AMCA failed to detect the intrusion despite numerous warnings from banks that processed its payments.
AMCA told Quest on May 14, 2019; Quest went public on June 3, 2019. AMCA then filed for bankruptcy, a proceeding later dismissed. Every American Medical Collection Agency lawsuit since has targeted the labs and their billing contractors. The complaints allege the labs failed to protect patient data and failed to notify people in time; the defendants deny it.
Case Details
On July 31, 2019 the Judicial Panel on Multidistrict Litigation centralized the cases as In re: American Medical Collection Agency, Inc., Customer Data Security Breach Litigation, MDL No. 2904, No. 19-md-2904 in the U.S. District Court for the District of New Jersey, before Judge Madeline Cox Arleo. The MDL runs in separate tracks by lab. The defendants include Quest, Optum360, Labcorp and Bio-Reference Laboratories.
In the Labcorp track, plaintiffs filed a consolidated complaint on November 15, 2019. Two rounds of motions to dismiss were each granted in part (December 16, 2021 and May 5, 2023). Plaintiffs moved for class certification on November 1, 2024, and the parties signed a settlement on March 2, 2026. In the Quest/Optum360 track, Quest's quarterly report for the period ending June 30, 2026 says “discovery and class certification proceedings are ongoing.”
Status: Labcorp Claims Closed, Quest Case Open
Quest and Optum360 patients — no settlement. As of Quest's July 2026 filing, this American Medical Collection Agency class action is still in discovery and class certification. There is no fund, no claim form and no deadline. Quest says a group of state attorney general offices is also investigating it.
States vs. Labcorp — settled, nothing to claim. On September 24, 2026, a coalition of 44 attorneys general announced a $2,287,455 settlement with Labcorp. The money goes to the states, not to patients. See our report on the attorneys general deal.
Who Is Affected
The breach notices covered more than 21 million people, according to TechTarget. The New York Attorney General puts it at over 27.5 million nationwide. Labcorp's share was 10,251,784 patients, per the HIPAA Journal. You were exposed only if a lab passed one of your bills to AMCA for collection. Being a Quest or Labcorp patient is not enough on its own.
Labcorp class: everyone whose information Labcorp transmitted to AMCA and which was on AMCA's systems at the time of the breach. Only people who filed a claim by September 3, 2026 receive cash. Class members who did nothing cannot sue Labcorp separately over this breach.
Quest, Optum360 and other labs: the proposed classes are not certified. If they ever are, or a settlement is reached, a court-approved administrator will send notice. Keep your 2019 notice letter, since it shows which lab sent your data.
What the Labcorp Settlement Pays
For Quest and Optum360 patients, there is no settlement, no fund and no claim form, and no court has valued those claims. The $2,287,455 state settlement and the 2021 AMCA deal with 41 attorneys general pay nothing to individuals. The 2021 deal's $21 million payment was suspended because of AMCA's bankruptcy.
How cases like this one end
Our copy of the federal courts’ own case database covers 24,037 other fraud casesclosed in U.S. federal district courts between 2015 and 2025, 27.4% of them filed as class actions:
- 17.3% ended in a settlement recorded by the court. Another 22.5% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 17.3% and 39.8%.
- 10.4% were decided on a motion before any trial.
- 1 in 111 reached a trial (0.9%), after a median of 30 months.
- Median time from filing to the end of the case: 7 months.
- Only 735 of them (3.1%) record a money award at all; the median of those is $663,000.
These are base rates for this type of case (federal other fraud cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
AMCA Breach Timeline
- 1
August 1, 2018 – March 30, 2019 — The Intrusion
An unauthorized user has access to AMCA's system, which holds billing, payment and personal data for patients of several labs.
- 2
May 14 – June 3, 2019 — Disclosure
AMCA informs Quest on May 14, 2019, and Quest announces it on June 3, 2019. Labcorp and Bio-Reference follow, AMCA files for bankruptcy, and the lawsuits begin.
- 3
July 31, 2019 — MDL No. 2904 Created
The JPML sends the cases to the District of New Jersey before Judge Madeline Cox Arleo. Thirty-two more tag-along actions had already been flagged.
- 4
March 2, 2026 — Labcorp Settles
After about six years of litigation, Labcorp signs a $35 million class settlement. Labcorp does not admit wrongdoing.
- 5
August 20 – September 3, 2026 — Approval and Claim Deadline
The final approval hearing is set for August 20, 2026, and RecordingLaw reports approval that day. Claims closed on September 3, 2026.
- 6
September 24, 2026 — States Settle With Labcorp
A coalition of 44 attorneys general announces $2,287,455 and vendor-security reforms. Nothing is payable to individuals, and the Quest track continues.
Three Things to Watch For
An old breach with a fresh settlement and a missed deadline is easy material for imposters:
“Late claim” or “reopened deadline” offers
The Labcorp claim deadline was September 3, 2026. A message offering to file a late claim, or to “reinstate” one for a fee, is not from Kroll. Only the administrator can say whether a late claim is accepted, and it never charges a fee.
“Quest AMCA settlement” claim pages
There is no Quest or Optum360 settlement. A site asking for your Social Security number or bank details to claim one is collecting data, not filing anything.
Calls about your “unpaid lab bill”
The stolen records included lab names, balances and dates of service, which is enough for a convincing fake collection call. Before paying, verify the bill with the lab directly, using the number on your own statement.
AMCA Data Breach — Questions People Actually Ask
What was American Medical Collection Agency?
AMCA was the trade name of Retrieval-Masters Creditors Bureau, Inc., a debt collector in Elmsford, New York. It collected small unpaid medical bills, mainly for labs such as Quest Diagnostics and Labcorp. It filed for bankruptcy after the breach, and that case was dismissed.
Can I still file a claim in the Labcorp AMCA settlement?
No. The claim deadline was September 3, 2026. Only the administrator, Kroll Settlement Administration (833-447-6786), can say whether any late claim is accepted. If you did file, payment comes after final approval and any appeals are resolved. As of October 2026 no payout date has been announced.
I was a Quest patient. Is there money for me?
Not as of October 2026. The Quest and Optum360 part of MDL 2904 is still in discovery and class certification, according to Quest's July 2026 filing. There is no settlement, no claim form and no deadline. If that changes, an administrator will send notice.
How much does the Labcorp settlement pay?
Up to $5,000 for documented losses, or an alternative cash payment estimated at $50, plus two years of medical-information monitoring. Payments come from a $35 million fund, so the cash figure can go up or down.
What is the attorneys general settlement with Labcorp?
On September 24, 2026, 44 attorneys general announced that Labcorp will pay $2,287,455 to the states and tighten its oversight of vendors. It has no claim form and pays nothing to patients. It is separate from the $35 million class settlement.
How do I know if my data was in the AMCA breach?
Your data was exposed only if a lab sent one of your bills to AMCA for collection. The labs mailed notices in 2019. Labcorp sent them to every patient for whom it had a valid address. If you have that letter, keep it; it names the lab and the data involved.
Is the settlement website real?
The Labcorp settlement is run by Kroll Settlement Administration at amcadatabreachsettlement83395.com, P.O. Box 5324, phone 833-447-6786. Kroll never charges a fee or asks for your full Social Security number by phone. See our guide to Kroll.
What should I do now?
Freeze your credit at all three bureaus, which is free and reversible. Check your health insurer's explanation-of-benefits statements for care you never received. Be wary of collection calls that quote old lab bills. If you filed a Labcorp claim, keep your confirmation.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.