$6.4 Million Settlement Agreed in AMCA Customer Data Breach Litigation
A settlement has been agreed to partly resolve litigation stemming from a cyberattack on American Collection Medical Agency (AMCA). The settlement resolves the “Other Labs Track” of the litigation and has been agreed to by the plaintiffs and AMCA clients Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc., and Austin Pathology Associates. The defendants have agreed to pay $6,438,578.20 to resolve all claims against them related to the AMCA data breach.
AMCA, a subsidiary of Retrieval-Masters Creditors Bureau, Inc., specializes in recovering small-balance medical debt for clinical laboratories and healthcare providers. The company identified a cyberattack on March 30, 2029, and the forensic investigation determined that an unauthorized third party had access to sensitive data between August 1, 2018, and March 30, 2019, following an attack on AMCA’s web payment portal. Data compromised in the incident included names, contact information, government-issued identifiers, medical billing information, financial account and payment information. More than 27 million individuals are believed to have been affected in total.
Many lawsuits were filed against AMCA and its clients in response to the data breach, asserting claims for negligence, breach of contract, and other claims. The lawsuits were consolidated in the U.S. District Court for the District of New Jersey, and after six years of hard-fought litigation, the defendants on this track – In Re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation (All Actions Against Other Labs Track) – have agreed to a settlement to avoid further litigation costs and the uncertainty of a trial and any associated appeals. The defendants continue to deny wrongdoing and liability and maintain that the plaintiffs and class members have not suffered any injury or damage as a result of the cyberattack or data breach.
The defendants have agreed to establish a $6,438,578.20 settlement fund to cover all costs and expenses related to the litigation, including attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and claims from the class members. Class members are entitled to claim two years of medical and health information monitoring through the CyEx Medical Shield Pro service. In addition, a claim may be submitted for compensation for documented, unreimbursed out-of-pocket losses due to the data breach up to a maximum of $5,000 per class member, which may include up to 10 hours of documented lost time at $25 per hour.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Class members who choose not to submit a claim for compensation of losses and/or lost time may choose to receive a one-time cash payment, the value of which will depend on the claims received, but has been estimated to be approximately $50. The important dates for class members are a deadline of December 3, 2026, for objecting to and opting out of the settlement, and January 4, 2027, for submitting a claim. The final fairness hearing has been scheduled for January 7, 2026.
