Hawaii Settled Labcorp Data Breach Investigation

Labcorp agreed to pay over $2.2 million to states following a 2019 vendor data breach.

Updated on Oct. 4, 2026 in Cybersecurity

Isometric editorial illustration of a clean steel server cabinet, representing secure digital infrastructure and corporate data oversight protocols. — Labcorp has agreed to pay over $2.2 million to a coalition of 44 states to settle a 2019 investigation into a major third-party vendor data breach. AI Illustration. Upload story photo >

Live Poll

Should large companies be held legally responsible for data breaches caused by their third-party vendors?

The Hawaii Department of Commerce and Consumer Affairs has finalized a settlement with Laboratory Corporation of America regarding a 2019 data breach at a third-party vendor. The breach exposed the personal information of 10.2 million Labcorp patients, including 17,347 Hawaii residents.

Why it matters

The settlement addresses Labcorp's failure to adequately oversee its vendor, American Medical Collection Agency, during the 2019 incident. It mandates new security protocols and vendor risk management assessments to protect patient data moving forward.

The 2019 breach at the American Medical Collection Agency compromised data belonging to over 27.5 million individuals. As part of the agreement, Labcorp must implement a robust information security program and hire a third-party auditor for vendor risk management.

The players

Hawaii Department of Commerce and Consumer Affairs

This state agency is responsible for overseeing professional licensing, business registration, and consumer protection efforts.

Laboratory Corporation of America

Labcorp is a global life sciences company that provides vital diagnostic information and drug development services.

The details

Labcorp will pay $2,287,455 to a coalition of 44 attorneys general, with Hawaii receiving $17,628 of that total. This action is separate from a $35,000,000 class action lawsuit settlement previously agreed upon by the company regarding the same incident.

The data breach occurred at AMCA in 2019.
A multistate coalition reached an initial settlement with AMCA in 2021.
The Hawaii Department announced the Labcorp settlement on October 4, 2026.

The Tech Race

This settlement highlights the intensifying industry focus on third-party vendor risk management within the healthcare sector. It follows a shift where corporations are increasingly held accountable for the cybersecurity failures of their contracted service providers.

Affected residents do not need to take immediate action, as the settlement focuses on future security mandates rather than direct payouts to individuals. Patients should remain vigilant regarding their medical statements and report any suspicious activity to their healthcare providers.

The takeaway

Companies are increasingly responsible for the cybersecurity practices of every vendor they engage. Consumers should consistently monitor their financial and medical accounts for unusual activity even years after a reported data breach.