The Debt Collector That Lost 10 Million LabCorp Patients' Data Went Bankrupt in Weeks. Seven Years Later, LabCorp Is Paying $35 Million — and 'To Date' Is Doing Heavy Lifting

Update, September 4, 2026: the claim deadline passed at the end of Thursday, September 3, 2026. We confirmed on the official Kroll-administered settlement website that it was not extended. Late claims are not accepted; the release still binds class members who did not opt out by July 27, 2026. The reporting below stands as written on its original date.

American Medical Collection Agency was a billing collector — the firm that lab companies handed overdue invoices to. Patients didn't pick it, and most never heard its name until 2019. Yet between August 1, 2018 and March 30, 2019 — the exact window that now defines the settlement class — an unauthorized intruder had access to AMCA's systems, reaching names, credit card and bank details, Social Security numbers for some, and medical billing information. Lab results themselves were not in AMCA's systems.

When the labs disclosed the breach in spring 2019, LabCorp's number came in at 10,251,784 patients. The fallout was immediate in one direction only: AMCA's parent company, Retrieval-Masters Creditors Bureau, filed for bankruptcy within weeks — which is why the class actions consolidated against the deep-pocketed labs instead, as MDL No. 19-md-2904 in the District of New Jersey. Seven years on, that procedural detour has finally produced a fund with a claim form: searches for “american medical collection agency data breach” are climbing again this week as notices circulate.

The official settlement site puts it plainly: a $35,000,000 fund, covering anyone who “received diagnostic services” and whose “personal information was accessed between August 1, 2018 through March 30, 2019” in the AMCA breach — for this settlement, via LabCorp. Three benefits stack for claimants:

Documented out-of-pocket losses up to $5,000 — fraud losses, credit-repair costs, and similar expenses traceable to the breach, with proof. An alternative cash payment, estimated at $50, for class members without documentation — pro rata in both directions, so heavy claim volume shrinks it and light volume grows it. And two years of CyEx Medical Shield Pro medical-data monitoring, which any class member can elect. Filing was free and took minutes on the administrator's site; the administrator is Kroll Settlement Administration.

Never got a letter? Eligibility turns on whether LabCorp sent your account to AMCA in that window — if a LabCorp bill went to collections around then, the LabCorp settlement tracker records what the class covered — the filing window itself ended on September 3, 2026.

The opt-out and objection deadline passed on July 27, 2026. If you did nothing, you are in the class and bound by the outcome — the only live decision left is whether to file a claim.

The final fairness hearing was held on Thursday, August 20, 2026 at 11:00 a.m. ET, in Courtroom 2C of the Martin Luther King, Jr. Federal Courthouse in Newark. Until it happened, the official site was scrupulous on this point: “The Court in charge of this case still has to decide whether to approve the settlement.” Nothing pays out until it does — and until any appeals resolve, which puts realistic payment timing in late 2026 at the earliest.

The claims deadline was Thursday, September 3, 2026 — submitted online by that day or postmarked by it. Unlike the hearing, that date was the claimant's to control. Missing it bars the claim entirely.

The MDL settlement site carries a sentence that rewards close reading: “To date, the Settling Defendants are: Labcorp.” And below it: “There may be future settlements in this Litigation with other Defendants.”

The largest single block of AMCA victims wasn't LabCorp's. Quest Diagnostics disclosed in June 2019 that approximately 11.9 million of its patients were exposed in the same intrusion — more than LabCorp's 10.25 million — and Quest is not among the settling defendants. This deal releases claims against LabCorp only. If your lab work ran through Quest, there is still nothing to file; the same MDL website is where any future Quest settlement would surface first.

For the medical-data-breach landscape more broadly — from DentaQuest to Medtronic — the pattern AMCA set still holds: the vendor fails, the vendor folds, and the customer-facing brand ends up funding the settlement years later.