CyberNew CyberNew
Data Breaches & Leaks The Record 3 weeks ago

Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Cloud & Distributed Infrastructure
Intelligence Sector
Data Breaches & Leaks

Analyst Takeaway

"Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings A bipartisan coalition of 44 state attorneys general on Thursday announced that they settled a lawsuit against Labcorp in exchange for a $2.3 million fine and a promise of sweeping data security reforms in the wake of a 2019 data breach that impacted 10.2 million customers. The data breach originated..."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
lab
Image: testalize.me / Unsplash

Labcorp to overhaul data security practices, pay $2.3 million fine for cybersecurity failings

A bipartisan coalition of 44 state attorneys general on Thursday announced that they settled a lawsuit against Labcorp in exchange for a $2.3 million fine and a promise of sweeping data security reforms in the wake of a 2019 data breach that impacted 10.2 million customers.

The data breach originated with security failings at American Medical Collection Agency (AMCA), a debt collector that Labcorp worked with.  The attorneys general contended that Labcorp should have don’t more to police AMCA, after the incident there impacted a total of 27.5 million people nationwide. 

Security changes include creating an incident response plan for vendor security failings, limiting how much data Labcorp shares with vendors and building an expansive risk management team charged with tracking vendors’ compliance with data security practices. 

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →