Labcorp Is Paying 44 Attorneys General $2,287,455 Over the 2019 AMCA Breach — About 22 Cents per Affected Patient, Paid to the States, With No Claim Form. The Patients’ Own $35 Million Settlement Stopped Taking Claims on September 3.

The Labcorp attorneys general settlement announced on September 24, 2026 is a state enforcement settlement, not a class action. Connecticut’s announcement puts it plainly: “Labcorp will make a payment of $2,287,455.00 to the states of which $81,296.00 is payable to Connecticut.” Colorado’s release says the state “is expecting to receive $32,086 from the settlement.” Neither release mentions a fund for patients, a claim form or a deadline for consumers.

If a message tells you to “claim your share” of the new Labcorp settlement, it is not describing this agreement. The only patient settlement against Labcorp over this breach is the $35 million class action, and it stopped accepting claims on September 3, 2026 (see below). Questions about the state settlement go to your own attorney general’s consumer line; Connecticut lists 860-808-5318.

What the states got besides money is a set of rules. Connecticut’s release lists them. Labcorp must build parts of its security program around vendors, including “an incident response plan that includes internal reporting of vendor security events.” It must minimize the data it shares with vendors and run a vendor-risk program with a dedicated team. It must add specific requirements for debt collectors — contract inventories, cybersecurity standards written into contracts, data segmentation, assessments and audits, and “the right of termination for non-compliance.” And it must hire a third-party assessor to review its information security, “with a focus on vendor risk management.”

The breach happened at AMCA, whose legal name is Retrieval-Masters Creditors Bureau. It collected unpaid bills for Labcorp and other labs. According to the states, it “potentially exposed the personal information of over 27.5 million individuals throughout the United States, including 10.2 million Labcorp patients.” Divided across those 10.2 million patients, $2,287,455 comes to about 22 cents per patient (our arithmetic).

The two releases we read give per-state figures that do not scale with the number of residents affected. Connecticut receives $81,296 for 43,666 affected residents, about $1.86 each. Colorado expects $32,086 for 130,522 residents, about 25 cents each (both our arithmetic). Connecticut was one of six states that led the investigation, together with Florida, Indiana, Illinois, Michigan and Texas; Maryland, Massachusetts, New York, North Carolina and Tennessee formed the executive committee. Neither release explains how the payment was divided.

Connecticut’s list of participants has 44 attorneys general: 43 states and the District of Columbia. California, Louisiana, Mississippi, Montana, North Dakota, South Dakota and Wyoming are not on it. The states had already settled with AMCA in 2021. That settlement, Connecticut notes, “included a $21,000,000 suspended payment due to its bankruptcy”, so the money is owed on paper but suspended.

The same Connecticut release notes that “Labcorp has agreed to a $35,000,000 settlement in the related class action lawsuit, which is still ongoing with other AMCA client covered entities.” That is In re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation, No. 19-md-2904 (D.N.J.), Labcorp track. As we reported on August 23, the court signed the final approval order on August 20, 2026 (Document 940). The order identified a class of 11,825,034 people.

The claim deadline was Thursday, September 3, 2026, and it was not extended. The Kroll-run Labcorp settlement website, read on September 28, 2026, still lists that deadline. It also still carries the sentence “The Court in charge of this case still has to decide whether to approve the settlement” — 39 days after the approval order was signed. The site gives no payment date. People who filed in time can reach the administrator at (833) 447-6786. We will update this page when the site names a payment date.

The class action continues against other labs whose patients were hit by the same AMCA breach. On August 20, 2026, the same court preliminarily approved a $6,438,578.20 settlement in what the case calls the Other Labs Track (Document 941). The defendants are Sonic Healthcare U.S.A., Aurora Diagnostics, Clinical Pathology Laboratories and Austin Pathology Associates. The order set notice by October 5, 2026, opt-outs and objections by December 3, 2026, and a fairness hearing on January 7, 2027.

The AMCA settlement portal links to a separate site for that settlement. When we opened it on September 28, 2026, it showed only a maintenance page. If you were a patient of one of those labs and receive a notice in October, that is a live claim, separate from anything involving Labcorp. For Labcorp’s own patients, the Labcorp claim window has closed.