The covered entity (CE), Laboratory Corporation of America Holdings dba LabCorp, reported that its business associate (BA) Retrieval-Masters Creditors Bureau, Inc. – American Medical Collection Agency (AMCA), was the victim of a cyber-attack involving the protected health information (PHI) of 10,251,784 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, phone numbers, health insurance information, and treatment information. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. As a result of this breach, LabCorp terminated its business relationship with AMCA.
What is known
People affected
10,251,784 (as reported to HHS)
Disclosed
Jul 13, 2019
Discovered
May 14, 2019
Happened
Aug 1, 2018
Attack
Hacking
Data exposed
Names, Social Security numbers, Payment cards, Financial, Health
2026-09-25 · data_types: ["names","ssn","payment-card","financial"] to ["names","ssn","payment-card","financial","health"] · backfill source
2026-09-25 · records_basis: organization to hhs · backfill source
2026-09-25 · records: 10241756 to 10251784 · backfill source
2026-09-25 · summary: empty to The covered entity (CE), Laboratory Corporation of America Holdings dba LabCorp, reported that its business associate (BA) Retrieval-Masters Creditors Bureau, Inc. – American Medical Collection Agency (AMCA), was the victim of a cyber-attac · backfill source
2026-09-25 · data_types: [] to ["names","ssn","payment-card","financial"] · backfill source
2026-09-25 · records_basis: empty to organization · backfill source
2026-09-25 · records: empty to 10241756 · backfill source
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · disclosed: 2019-07-15 to 2019-07-13 · backfill source
2026-09-25 · discovered: empty to 2019-05-14 · backfill source
