Labcorp $35 Million AMCA Data Breach Settlement: Claim Deadline Passed, Payments Pending

Labcorp used AMCA, a company formally named Retrieval-Masters Creditors Bureau, Inc., to collect unpaid lab bills. Hackers got into AMCA's payment systems for months. According to the Maryland Attorney General, the AMCA breach potentially exposed information on more than 27.5 million people nationwide, including 10.2 million Labcorp patients. Exposed data could include names, addresses, Social Security numbers, financial information, and some medical test and billing information.

Lawsuits against AMCA and the labs that used it, including Quest Diagnostics and Labcorp, were combined into multidistrict litigation, MDL No. 2904, in the U.S. District Court for the District of New Jersey. The Labcorp track is titled In re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation (All Actions Against Laboratory Corporation of America Holdings), Civil Action No. 19-md-2904. Judge Michael A. Hammer held the final fairness hearing.

Labcorp denies all claims and all wrongdoing, and the settlement is not an admission that it broke any law. The plaintiffs argued Labcorp was responsible for protecting patient data it handed to its vendor. For how cases like this are grouped, see what MDL means.

The settlement class is every individual for whom Labcorp transmitted personal information to AMCA, where that information was in the AMCA computer systems involved in the cyberattack between approximately August 2018 and March 2019. In practice, that means Labcorp patients who had a bill sent to AMCA for collection.

• Most class members received a postcard or email notice with a class member ID.
• You did not need to have suffered identity theft to be in the class.
• Labcorp's officers and directors, the judges on the case, and anyone convicted of causing the breach are excluded.

Quest Diagnostics and other lab patients whose data was at AMCA are not covered by the Labcorp settlement; their claims are handled in separate tracks of the same MDL. If you got a data breach letter from AMCA in 2019 that referred to Labcorp, you were likely in this class.

The $35 million fund pays for class benefits, notice and administration, taxes, service awards, and attorneys' fees. Class members could pick one of two payment types, plus monitoring:

Out-of-pocket losses could include unreimbursed fraud losses, professional fees, postage and similar costs, and credit monitoring bought on or after August 1, 2018. Handwritten or self-prepared receipts alone were not enough; loss claims needed third-party documentation and a statement that the losses were fairly traceable to the AMCA incident.

Both cash options are pro rata. The $50 figure is an estimate: the cash payment is what is left in the net fund after losses and costs, divided evenly among valid cash claims. Class counsel asked for attorneys' fees of up to 34% of the fund and $5,000 service awards for each class representative. With more than 10 million people in the class, a high claim rate could push the cash payment below $50, while a low one could raise it. Our guide on what data breach settlements are worth shows typical results.

Claims were filed online at the official settlement website or by mailing a paper claim form to Kroll postmarked by September 3, 2026. That window has closed. If you filed:

1. Keep your confirmation email or claim ID.
2. Watch for messages from Kroll asking for missing documents, especially if you claimed losses.
3. Update your mailing or email address with the administrator by calling (833) 447-6786 if it changes.
4. Expect payments only after the approval order is final and any appeal period ends.

The settlement administrator is Kroll Settlement Administration LLC, PO Box 5324, New York, NY 10150-5324. Kroll will never charge you to receive a payment. For tips on following up, see what to do if you have not received a settlement check.

As of September 2026, the claim period has ended, a Final Approval Order and Judgment appears on the settlement's documents page, and no payment date has been announced. Payments typically follow the end of any appeal period and the administrator's review of claims, which can take several months.

If you did not file by September 3, 2026 and did not opt out by July 27, 2026, you will not receive a payment and you have released your claims against Labcorp over the AMCA incident. You can still contact Kroll to ask whether late claims will be considered, but there is no guarantee.

You can also still protect yourself. Credit freezes at Equifax, Experian, and TransUnion are free, and our guide on what to do after a data breach notice lists the steps. The separate $2.3 million multistate settlement announced by 44 attorneys general in September 2026 goes to the states and requires Labcorp to tighten vendor security; it does not have a claim process for individuals.

Other health data settlements include the Highlands Oncology data breach settlement and the Globe Life data breach settlement. If your data was exposed in a newer breach and you had real losses such as fraudulent charges, see our data breach lawsuit page. For this settlement, check the official settlement website linked above for payment updates. If you have large documented losses from a breach that is still being litigated, a free case review can connect you with independent attorneys who handle these cases.