Alaska asks court to approve its share of $2.3 million Labcorp data breach settlement

Alaska has asked an Anchorage judge to approve its part of a $2.3 million multistate settlement with Labcorp over a 2019 data breach at the medical testing company's debt collector, which potentially exposed information on 10.2 million Labcorp patients nationwide.

Acting Attorney General Cori Mills's office filed the petition Thursday in Anchorage Superior Court, the same day a coalition of 44 attorneys general, including Alaska's, announced the settlement. State law requires court approval for this kind of agreement, in which a company promises to change its practices. The agreement is not an admission of wrongdoing, and the attorney general can reopen the matter later.

The breach happened at American Medical Collection Agency, the business name of Retrieval-Masters Creditors Bureau, which Labcorp used to collect medical debts. Someone had unauthorized access to the collector's system from Aug. 1, 2018, through March 30, 2019. The breach potentially exposed information on more than 27.5 million people across all of the collector's clients, including 10.2 million Labcorp patients. Labcorp has said its own systems were not affected and that no test orders, results or diagnostic information from the company were in the collector's system.

"Labcorp was responsible for vetting and managing that vendor," said Connecticut Attorney General William Tong, whose office led the investigation.

Labcorp will pay $2,287,455 to the states. Shares published by other states include $81,296 for Connecticut, $43,313 for Pennsylvania and $17,534 for Wisconsin. The money goes to the states, not to consumers. States that need court approval, as Alaska does, receive payment after it is granted.

The settlement also requires Labcorp to appoint a chief information security officer and to have an independent firm assess how it manages the security risks of its vendors within 18 months of the Oct. 1 effective date. Its vendor-management requirements last until Oct. 1, 2031.

The agreement adds to a 2021 multistate settlement with the debt collector itself, which included a $21 million payment that was suspended because of the collector's bankruptcy. Labcorp has separately agreed to pay $35 million to settle a related class-action lawsuit, which is still ongoing against other companies the collector served.