AMCA Data Breach Lawsuit: Labcorp, CareCentrix, and Quest Settlements

The AMCA data breach lawsuit is a consolidated class action in the U.S. District Court for the District of New Jersey (MDL No. 2904) covering roughly 25 million patients whose information was exposed when an intruder accessed American Medical Collection Agency’s payment portal between August 2018 and March 2019. It has produced a $6.3 million settlement with CareCentrix (already paid out), a $35 million settlement with Labcorp with claims open through September 3, 2026, and an unresolved track against Quest Diagnostics and Optum360. AMCA itself went bankrupt and is not a source of individual compensation.

Who Was Affected

AMCA, a medical debt collection agency in Elmsford, New York, held billing data for dozens of laboratories and healthcare providers. An intruder accessed its internal systems from August 1, 2018 through March 30, 2019 and obtained patient names, Social Security numbers, payment card information, and in some cases the names of medical tests and diagnostic codes.¹ Notifications went out starting June 3, 2019.²

At least 23 healthcare organizations were affected. The largest patient populations:

Quest Diagnostics/Optum360: approximately 11.9 million patients
Labcorp: approximately 10.25 million patients
Clinical Pathology Laboratories: approximately 2.2 million patients
CareCentrix: approximately 467,600 patients
BioReference Laboratories (OPKO Health): approximately 422,600 patients
American Esoteric Laboratories: approximately 409,800 patients

Smaller laboratories and pathology practices accounted for the rest, with affected populations from a few thousand to over 170,000.³

If you used any of these providers for lab work or billing during that period, you may have received a notice in 2019, and you may be a class member in one of the settlement tracks below.

Labcorp Settlement: $35 Million, Claims Open Through September 3, 2026

The largest and most urgent piece of the litigation is the Labcorp settlement. Labcorp agreed to pay $35 million to resolve claims on behalf of the more than 10.2 million patients whose billing information passed through AMCA’s systems.⁴ Labcorp denies wrongdoing.

Eligible class members can choose from three benefits:

Reimbursement of up to $5,000 per person for documented out-of-pocket expenses tied to the breach. This covers identity theft losses, credit monitoring you paid for, legal fees, and up to 10 hours of lost time valued at $25 per hour. You must provide receipts or other documentation.
An alternative cash payment estimated at $50, with no proof required.
A two-year membership to CyEx Medical Shield Pro, which includes medical information monitoring and identity theft insurance.⁵

Key dates:

Deadline to object or opt out: July 27, 2026
Claim filing deadline: September 3, 2026 (online submission or postmark)
Final fairness hearing: September 3, 2026⁴

Kroll Settlement Administration is running claims. File at the official settlement website, AMCADataBreachSettlement83395.com, or by mail.⁶ Payment amounts and the availability of the alternative cash option depend on final court approval, which had not yet been issued as of mid-2026.

Lead class counsel are James E. Cecchi of Carella, Byrne, Cecchi, Brody & Agnello; Linda P. Nussbaum of Nussbaum Law Group; and Stuart A. Davidson of Robbins Geller Rudman & Dowd.⁷

CareCentrix Settlement: $6.3 Million, Already Paid Out

CareCentrix, whose data for roughly 420,000 individuals was involved in the breach, settled for $6.3 million. The court granted preliminary approval on May 2, 2023 and held its final fairness hearing on October 31, 2023.⁸ Benefits included up to $5,000 for documented losses, an alternative $50 payment, and at least three years of credit monitoring. California residents received an additional $50. Payments have been issued and the claim period has closed.⁹

Quest Diagnostics and Optum360: Still Pending

Quest Diagnostics and Optum360, its billing contractor, are defendants in the largest track of the MDL by patient count. As of January 2024, fact discovery had largely closed and the case was described as approaching an advanced stage.¹⁰ No settlement has been announced, and no claim is available yet for Quest patients. If you were notified in 2019 that Quest was the provider that sent your data to AMCA, watch for news of a separate settlement in this track.

What the Lawsuits Argued

The consolidated complaints did not target AMCA alone. They sued the healthcare companies that had sent patient data to AMCA, on the theory that Quest, Labcorp, CareCentrix, and the others had a duty to vet a vendor holding this much sensitive information. Claims included negligence, negligence per se based on HIPAA security requirements, unjust enrichment, breach of implied contract, invasion of privacy, and violations of state consumer protection and data breach notification statutes across more than a dozen states.¹¹ Because each defendant had a different patient population and different exposure, the MDL has proceeded on separate tracks with separate settlements rather than one combined resolution.

The case is captioned In re: American Medical Collection Agency, Inc., Customer Data Security Breach Litigation, MDL No. 2904, before Judge Madeline Cox Arleo.¹²

Why You Cannot Sue AMCA Directly

AMCA’s parent company, Retrieval-Masters Creditors Bureau, filed for Chapter 11 bankruptcy on June 17, 2019 in the Southern District of New York (Case No. 19-23185) after losing its major clients within weeks of the breach disclosure.¹³ The company reported liabilities between $1 million and $10 million and cut more than 75 percent of its workforce. The bankruptcy case was dismissed on December 9, 2020 after AMCA reached agreement with state attorneys general.¹ There is no consumer recovery available from AMCA itself. The class action money comes from the healthcare companies that sent data to AMCA.

The Separate State Attorney General Settlement

Parallel to the class action, a bipartisan coalition of 41 attorneys general led by North Carolina, Indiana, and Texas reached a settlement with AMCA on March 11, 2021.¹⁴ The investigation found that AMCA had ignored repeated warnings from payment processing banks about compromised cards. The settlement imposed a $21 million penalty, suspended because of AMCA’s finances unless the company violates the agreement, and required AMCA to build a formal information security program.¹⁵ This is a regulatory enforcement settlement and does not pay individual consumers. If you want compensation, the class action tracks above are the route.

1
New York State Attorney General. Attorney General James Holds American Medical Collection Agency Responsible for 2019 Data Breach
2
Illinois Attorney General. Settlement With American Medical Collection Agency Over Data Breach
3
HIPAA Journal. AMCA Data Breach Total Nears 25M
4
HIPAA Journal. Labcorp AMCA Data Breach Settlement
5
ClassAction.org. $35M Labcorp Settlement Reached in AMCA Data Breach Lawsuit
6
Kroll Settlement Administration. AMCA Data Breach Settlement Documents
7
ClassAction.org. Labcorp Settlement Agreement
8
U.S. District Court for the District of New Jersey. Order Granting Preliminary Approval, CareCentrix Settlement
9
AMCA Data Settlement – CareCentrix. CareCentrix Settlement
10
Judicial Panel on Multidistrict Litigation. MDL-2904 Transfer Order
11
Berger Montague. Consolidated Class Action Complaint, Quest Diagnostics Track
12
U.S. District Court for the District of New Jersey. American Medical Collection Agency, Inc., Customer Data Security Breach Litigation
13
SecurityWeek. AMCA Files Bankruptcy Following Data Breach
14
North Carolina Department of Justice. Attorney General Josh Stein Announces Settlement Over American Medical Collection Agency Data Breach
15
Nevada Attorney General. Attorney General Ford Announces Multistate Settlement With American Medical Collection Agency Over 2019 Data Breach