A bipartisan group of 44 state attorneys general announced a significant settlement with **Laboratory Corporation of America (Labcorp)** on Thursday. The agreement mandates a $2.3 million fine and extensive data security overhauls in response to a 2019 data breach that affected 10.2 million of its customers. The breach originated from security vulnerabilities at **American Medical Collection Agency (AMCA)**, a debt collector that partnered with **Labcorp**. The attorneys general argued that **Labcorp** failed to adequately oversee **AMCA**, especially given that the incident impacted a total of 27.5 million individuals nationwide across multiple entities. Key security enhancements required of **Labcorp** include developing a robust incident response plan specifically for vendor-related security failures. The company must also limit the amount of data shared with vendors and establish a comprehensive risk management team dedicated to monitoring vendor compliance with data security protocols. Furthermore, **Labcorp** is now obligated to incorporate stringent cybersecurity requirements into all vendor contracts. This includes mandating that data collectors routinely provide the medical testing giant with audits demonstrating adherence to these new rules. The settlement also requires **Labcorp** to engage an independent expert to conduct regular information security assessments. A critical new measure is the siloing of data, preventing debt collectors from aggregating sensitive information from multiple clients, a practice that often increases breach exposure. In 2021, a court previously sided with attorneys general suing **AMCA**, ordering the debt collector to pay a $21 million fine. However, this payment was suspended due to the company's subsequent bankruptcy. New York Attorney General **Letitia James** emphasized the importance of the settlement, stating, “Millions of patients’ private health information was potentially exposed because of Labcorp’s failures to protect its customers. As a result of our investigation, Labcorp will make critical changes to protect patients and prevent this kind of data breach from happening again.” **Labcorp** has not yet issued a press release regarding the settlement, and a spokesperson did not immediately respond to requests for comment.