American Collection Medical Agency agrees $6.44 million settlement over 27 million data breach

What happened

• A $6,438,578.20 settlement was reached to resolve the "Other Labs Track" of litigation over a cyberattack on American Collection Medical Agency.
• The breach, discovered on 30 March 2029, exposed personal and medical billing data of more than 27 million individuals between August 2018 and March 2019.
• Plaintiffs include several laboratory clients and class members who may claim monitoring services or compensation.
• The settlement fund will cover legal costs, monitoring services, and up to $5,000 per claimant.
• Class members must object or opt out by 3 December 2026 and submit claims by 4 January 2027.

Why it matters

Medical‑debt collectors and affiliated labs should audit breach‑response protocols and ensure timely class‑member notifications to avoid similar litigation exposure.

Business impact

Settlements impose significant cash outlays and require ongoing monitoring services, affecting profit margins and operational budgeting.

What to check

1. 1

   Audit breach response planHigh priority

   Verify that incident detection, containment, and notification procedures meet HIPAA breach requirements.

2. 2

   Implement class‑member notice processHigh priority

   Send settlement notices with clear opt‑out and claim‑submission deadlines to all affected individuals.

3. 3

   Offer health‑monitoring servicesMedium priority

   Provide two‑year medical identity monitoring to class members as stipulated in the settlement.