“A medical data breach isn’t just about spam emails. The real damage arrives months later — on your credit report, as a collection account for a hospital bill you never ran up.”
If you were a Labcorp patient at any point before early 2019, there’s a $35 million class action settlement open right now — and most people who qualify have no idea it exists. The claim deadline is September 3, 2026. The settlement website is live. Filing takes a few minutes.
I’m writing this because the hidden danger in this particular breach isn’t the obvious stuff. It’s what can show up on your credit report a year from now: a collection account for a medical bill you never incurred, from a provider you’ve never heard of, using your Social Security number and date of birth that were stolen in 2018.
That’s medical identity theft. And it’s the part most data breach coverage misses entirely.
Similar data breach settlements have come and gone quietly — I’ve covered the Comcast settlement, the Krispy Kreme settlement, and the Fidelity settlement. The playbook is always the same: file your claim, then protect yourself from the real damage.
The Daily Money Brief — Free, at 10 AM
Money you may be owed, scams to dodge, and the fine print decoded — the consumer money news that affects your wallet, every weekday.
What You Need to Know — The Breach and the Settlement
Between August 2018 and March 2019, a medical debt collection company called American Medical Collection Agency (AMCA) — also known as Retrieval-Masters Creditors Bureau Inc. — suffered a major cyberattack. AMCA was collecting past-due lab bills on behalf of Labcorp.
The official settlement website confirms that approximately 7.7 million Labcorp patients had their information exposed. The data that was compromised could include:
- Full name, address, and date of birth
- Social Security number
- Credit card or bank account numbers (for anyone who paid AMCA)
- Medical billing information and balance data
Labcorp denies wrongdoing but agreed to pay $35 million to settle the claims. The case is In re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation, Civil Action No. 19-md-2904, in the U.S. District Court for the District of New Jersey. Court approval of the settlement is still pending.
Who Qualifies
You may be eligible if you received diagnostic services from Labcorp and had a past-due balance sent to AMCA during the breach window (August 2018 – March 2019). If you’re not sure whether that applies to you, file a claim anyway — the settlement administrator will determine eligibility.
What You Can Claim
- Up to $5,000 for documented out-of-pocket losses — identity theft remediation, legal fees, credit monitoring you paid for, time you lost dealing with fraud (at $25/hour)
- Approximately $50 as an alternative cash payment, no documentation required
- Two years of complimentary medical identity monitoring services (available to all eligible class members)
Key Deadlines
- Opt-out or object: July 27, 2026
- File your claim: September 3, 2026
- Final fairness hearing: August 20, 2026 (Newark, NJ)
Why You Need to Know This — The Hidden Danger
Here’s what 30 years of watching people deal with debt has taught me: most people think a data breach means a few weeks of junk mail and then it’s over.
With medical data, that’s not how it works.
When someone has your Social Security number, your date of birth, and your medical billing information, they can do something particularly insidious: they can use your identity to receive medical care, run up bills in your name, and those bills end up in collections. The collection account lands on your credit report. You find out about it when you’re denied a car loan, an apartment application gets rejected, or a debt collector calls you about a bill from a hospital you’ve never set foot in.
This is called medical identity theft, and it’s different from regular identity theft in one critical way: the damage is often invisible for months or years. The fraudulent care was received. The bill was sent to a wrong address. The collection account quietly appeared on your credit file. And meanwhile, you have no idea.
The other thing worth knowing: medical collections still affect your credit score even after recent rule changes. Any new medical collection that shows up — one created by someone using your stolen information after 2019 — is fair game for collectors and credit bureaus.
For a deeper look at how medical debt and collections interact with your credit report, I covered the larger picture when Connecticut erased $315 million in medical debt and what it means for everyone else.
Things to Consider
The Settlement Claim Is Step One, Not the Whole Story
Filing your claim protects your financial interest in the settlement. But it does nothing to detect or stop the secondary damage that may already be in progress.
The two years of medical identity monitoring that come with this settlement are valuable. But monitoring tells you after something has gone wrong. The steps in the next section are the ones that actually prevent the damage.
If You Have Medical Collections You Don’t Recognize
Pull your credit reports right now at annualcreditreport.com — it’s free, it’s the official site, and you can get all three bureau reports weekly. If you see any medical collection you don’t recognize, that’s a red flag worth investigating immediately.
I’ve covered what to do in that situation: what to do if you’re being sued for medical debt and how courts are treating fake debt collector situations. The short version: you have rights under the Fair Credit Reporting Act, and you can dispute any account you don’t recognize directly with each bureau.
The AMCA Breach Was Bigger Than Labcorp
Twenty-four million people across 21 companies had data exposed in the AMCA breach, according to reporting from the time. Labcorp is the only defendant with a finalized settlement so far. The court has indicated future settlements with other defendants are possible. If you received services from Quest Diagnostics or another company that used AMCA, watch for separate settlement notices in the future.
What to Think About Doing — The Specific Steps
Step 1: File Your Claim Now
Go to amcadatabreachsettlement.com and file online before September 3, 2026. The claim form is straightforward. You’ll be asked whether you have documented losses; if you do, gather receipts and records. If you don’t, select the alternative cash payment option. You can also call (833) 447-6786 for help.
If you received a settlement notice in the mail with a Class Member ID, use that number. If you didn’t receive a notice, you can still file — provide your own information and the administrator will verify eligibility.
Step 2: Pull Your Credit Reports
Get all three bureau reports at annualcreditreport.com. Look specifically for:
- Medical collection accounts you don’t recognize
- Addresses you’ve never lived at
- Medical providers you’ve never visited
- Hard inquiries you didn’t authorize
Step 3: Freeze Your Credit at All Three Bureaus
A credit freeze is free, doesn’t hurt your credit score, and stops anyone from opening new accounts in your name. Do this even if you see nothing wrong on your reports — it’s the best preventive measure available. Contact each bureau directly to place a freeze:
- Equifax: equifax.com
- TransUnion: transunion.com
- Experian: experian.com
Step 4: Review Your Explanation of Benefits
If you have health insurance, log into your insurance portal and review your Explanation of Benefits (EOB) statements for any services you don’t recognize. If someone used your insurance with your stolen data to receive care, it will appear there before it appears anywhere else.
Step 5: Set Up Free Monitoring Alerts
Even with a credit freeze in place, consider signing up for free credit monitoring through your bank or credit card issuer if offered. Alerts for any new account, address change, or hard inquiry give you an early warning system on top of the freeze.
I’m Steve Rhode, and I’ve been writing about debt and consumer protection for more than 30 years. None of this is legal advice — I can’t know your full situation, and only you can decide what the right move is for you. But I can tell you what I’d do: file the claim, pull the reports, freeze the credit, and then stop worrying about it. You’ve done what you can do.
If this helped you, send it to someone who gets Labcorp lab work done. They may qualify and have no idea.
More open settlements: the Trader Joe’s receipt settlement deadline is June 9, 2026 — if you shopped there with a card in 2019, you may be owed about $102.
If your bank rather than your medical provider was breached, the danger shifts — see how to handle Flagstar Bank’s $31.5 Million Data Breach Settlement.
Dealing With Debt? Understanding your options is the first step. See how all your debt relief options compare — including ones most sites won’t tell you about. The Find Your Path quiz gives a recommendation based on your actual numbers, and the Scam-O-Meter checks any company’s complaint history before you sign. Federal Reserve research shows bankruptcy filers recover faster than those who don’t file.
Claiming money you are owed is one good day. What you do over the following year is what actually changes your position.
I write Your Money Actually most weekdays — what I am watching in debt and money, and the small decisions that compound. It is free, I sell nothing, and I take no money from any company I write about.
