On September 24, 2026, the New York Attorney General announced that Labcorp had agreed to a multistate settlement totalling $2,287,455, with 44 states and the District of Columbia taking part. The case concerns a breach that ran from August 2018 to March 2019 inside the systems of American Medical Collection Agency (AMCA), a debt collector that worked for Labcorp and other healthcare providers. A hacker accessed AMCA’s internal system and exposed personal information, including Social Security numbers, payment card details and medical test information, for more than 27.5 million people nationwide, about 420,000 of them in New York.
The breach was in the vendor’s environment, yet the regulators’ settlement is with the company whose customers’ data was shared. This article explains what the settlement requires, why vendor breaches keep ending this way, and a six-step plan any enterprise can use to prepare before a supplier is the next headline.
Crest.Digital’s AI-powered vendor intelligence platform keeps continuous watch on third-party cyber, financial and compliance signals, so oversight does not depend on the next annual questionnaire.
See the PlatformA 2019 Vendor Breach, a 2026 Settlement
Two features of this case matter beyond healthcare. The first is time. The breach happened in 2018 and 2019, and the settlement was reached in 2026. A vendor incident does not end when the vendor cleans up; it can follow the customer organisation for years through litigation, regulatory investigation and reputational damage. The second is accountability. As The Record reported, the failure originated in the collection agency’s own security weaknesses, and Labcorp still paid and still accepted oversight obligations.
The attorneys general also noted that AMCA did not detect the intrusion despite repeated warnings from banks about suspicious activity. That detail is instructive. Signals existed outside the vendor, but nobody with the authority and the information to act on them joined them up in time. Ask how many of your suppliers would receive, and act on, a similar warning from a bank, a card network or a researcher.
What the Settlement Actually Requires
The reforms Labcorp agreed to are worth reading as a checklist, because they describe what regulators consider reasonable vendor oversight after the fact. According to the New York Attorney General’s summary, the company must:
Five Obligations Any Enterprise Can Borrow
- Strengthen its security programme and incident response. This includes an incident response plan with internal reporting channels for vendor breaches, so a supplier’s bad news reaches the right people quickly.
- Minimise the data shared with vendors. Share only what the service needs, consistent with its debt-collection obligations.
- Expand vendor risk management. A dedicated team, evaluation tools and checks that vendors actually comply, not just promise to.
- Set cybersecurity requirements for collectors. Standards, data segmentation, assessments and audits, and the right to terminate for non-compliance.
- Appoint an independent assessor. A third party evaluates information security with a focus on vendor risk management.
None of this is exotic. It is what mature third-party risk programmes already aim to do, and it matches the direction of travel in other jurisdictions, such as the shift described in our analysis of US banking regulators’ TPRM guidance overhaul. The difference is that here the programme was mandated after harm, not built before it. Healthcare and pharma organisations will recognise the exposure from our guide to third-party risk in healthcare and pharma, but the pattern applies to any business that shares customer data with collectors, processors, call centres or outsourced finance operations.
Where the Oversight Gap Usually Hides
Vendor breaches that become regulatory cases rarely involve a vendor nobody had heard of. They involve a vendor that was known, contracted and, on paper, reviewed. Three gaps recur.
Data sprawl. Over time, vendors collect more data than the service needs, and fields added for one reason stay in the feed. The debt collector in this case held a mix of payment, identity and diagnostic information. Data minimisation is the cheapest control because it reduces the size of every future loss.
Point-in-time assurance. A questionnaire or audit report describes the vendor on the day it was completed. The risk lives in the months between assessments, when staff leave, systems change and patches slip. As we argue in continuous evidence, not just continuous monitoring, what a regulator or auditor will ask for is proof that the control kept operating, not a promise that it exists.
Contract without enforcement. Security clauses, audit rights and termination triggers are only as strong as the process that uses them. Our piece on vendor contract risk management covers how to turn clauses into monitored obligations, and our look at fourth-party risk explains why the chain behind your vendor matters too.
A Six-Step Plan to Prepare Before the Vendor Calls
The plan below turns the settlement terms into an operating sequence. It follows the same discover, design, connect, deploy, validate and transfer logic we use for continuous assurance work.
Map Which Vendors Hold Which Data
Build a register of every vendor that receives personal, financial or health data, the specific fields shared and the system or channel used. Include collectors, processors and outsourced service providers that are easy to miss, and tier them by data sensitivity and volume.
Cut the Data Shared to What the Service Needs
For each vendor, remove fields that do not serve the contracted purpose and set retention and deletion dates. Where a vendor serves several clients, require logical separation of your data from other clients' data.
Write Security and Audit Rights Into the Contract
Specify minimum security controls, breach notification timelines, the right to audit or receive independent assurance reports, flow-down to subcontractors, and termination rights for non-compliance.
Verify Controls Continuously, Not Annually
Combine external monitoring, event-driven reviews and scheduled evidence refreshes. Treat warnings from third parties, such as banks, card networks or researchers flagging suspicious activity, as triggers for immediate review.
Rehearse the Vendor-Breach Incident Plan
Define who is told, how fast and by what route when a vendor reports or you detect a breach. Test the plan with a tabletop exercise that includes the vendor, legal, privacy, communications and the business owner.
Report Vendor Exposure to Leadership and Test It Independently
Give the risk committee a regular view of vendors by data tier, overdue findings and incidents, and have internal audit or an independent assessor test that the programme works in practice.
Independent testing matters here for the same reason it was imposed on Labcorp. Internal audit, guided by the standards of the Institute of Internal Auditors, can test that vendor controls and your own oversight work as designed, while frameworks such as ISACA’s COBIT help structure what good looks like. For organisations that hold health data in the US, the HHS HIPAA guidance adds specific obligations for business associates. Our article on why ISO 27001 auditors want proof that controls run applies the same evidence logic to your own certification.
Crest.Digital’s Agentic GRC connects vendor evidence, exceptions and remediation, so an overdue fix is a tracked item with an owner and not a line in an email. Relevant across regulated industries.
Where Agentic AI Helps, and Where Judgement Stays Human
Most of the work in the plan is high-volume and repetitive: watching external signals, collecting and checking evidence, chasing overdue fixes and comparing contracts with policy. This is where agentic AI earns its place. Agents can monitor each vendor for adverse signals, request and validate current certificates and audit reports, flag when data fields exceed the contracted scope, open an exception, notify the owner and track the fix to closure. When a vendor reports a breach, an agent can assemble the incident pack: the contract, the data shared, the last assessment and the open findings.
What agents should not do is decide on their own that an incident is material, what must be notified or whether to end a relationship. Those calls belong to accountable people in security, legal, privacy and the business. Each automated step needs a log of what was reviewed, which rule fired and who approved the result, the principle we describe in why AI agents need audit trails. And, as we note in evidence is not assurance, the pipeline supplies evidence; people reach the conclusion. Open exceptions should follow the closed-loop discipline in our piece on audit issue remediation follow-up agents.
Your Turn: How Would You Fare If a Vendor Called Today?
- Reactive: Vendor reviews happen annually and the incident plan does not mention suppliers.
- Managed: Vendors are tiered, contracts carry security clauses and data shared is mapped, but evidence refresh is manual.
- Continuous: Signals are monitored, data scope is minimised, exceptions are tracked to closure and leadership sees vendor exposure regularly.
Where does your programme sit today? Tell us in the comments when you share this on LinkedIn.
Crest Perspective
Cyber risk in vendor relationships is not uniformly distributed. The vendors that represent the highest exposure are rarely those with the longest questionnaire responses — they are the ones with privileged access to production systems, those processing unstructured data at scale, and those operating in jurisdictions with limited breach notification requirements. Risk tiering that reflects actual access and data flows is more predictive than vendor size or certification status alone.
Frequently Asked Questions
In the September 2026 multistate settlement, announced by 44 state attorneys general and the District of Columbia, Labcorp agreed to pay about $2.3 million and to strengthen how it governs vendors. The terms reported by the New York Attorney General include an information security programme and incident response plan with internal reporting of vendor breaches, minimising the data shared with vendors, an expanded vendor risk management function with dedicated staff, tools and compliance verification, cybersecurity and audit requirements for debt collectors with termination rights, and an independent third-party assessor focused on vendor risk management. It reads as a practical checklist for any enterprise.
Yes. Although the breach occurred in the systems of the debt collector, American Medical Collection Agency, regulators pursued Labcorp because it had chosen to share patient data with that vendor and was expected to oversee how the data was protected. Under US state consumer protection and privacy laws, and under regimes such as GDPR and India's DPDP Act, the organisation that decides why and how personal data is processed generally remains accountable for it, even when a supplier handles it day to day. Contracts can allocate cost, but they do not transfer regulatory responsibility.
Data minimisation means sharing with each vendor only the data it needs to perform the contracted service, for only as long as it needs it. In vendor risk terms it reduces the potential impact of any single breach, because the data that was never shared cannot be exposed. Practical steps include mapping which data fields go to which vendor, removing unnecessary fields such as full payment details or diagnostic codes, segmenting data by client, setting retention and deletion dates, and re-checking the data flow at each contract renewal.
It depends on the vendor's criticality and the sensitivity of the data it holds, but an annual questionnaire alone is rarely enough for vendors that hold regulated personal data. A common pattern is continuous external monitoring for all vendors, event-driven reviews when the vendor changes ownership, hosting, subprocessors or product, and scheduled evidence refreshes for high-risk vendors, such as current audit reports, penetration test summaries and evidence that access reviews actually ran. The aim is to detect drift between assessments, which is where gaps like the AMCA case tend to develop.
Agentic AI can monitor external signals about vendors, collect and validate evidence such as certificates and audit reports, chase overdue remediation, check contract clauses against policy, and assemble an incident pack when a vendor reports a breach. People still decide which vendors are critical, whether an incident is material, what to notify and to whom, and whether to terminate a contract. Every automated action should be logged with the source, the rule applied and the approver so internal audit and regulators can trace what was done and by whom.