Cybersecurity · Industry brief

Labcorp reached a settlement in a multidistrict litigation case involving a 2018-2019 data breach at American Medical Collection Agency (AMCA), a debt-collection vendor handling patient accounts. The breach exposed personally identifiable and protected health information of Labcorp patients; the company faced negligence allegations for inadequate vendor security oversight. After six years of litigation including motions to dismiss and expert discovery, U.S. District Court for the District of New Jersey approved the settlement on August 20, 2026, under case number 19-md-2904 (Judicial Panel on Multidistrict Litigation consolidated three tracks: Quest/Optum, Labcorp, and Other Labs).

American Renal Management LLC (Innovative Renal Care) reached a $900,000 settlement to resolve consolidated litigation stemming from a February 2024 data breach affecting 59,400 individuals. The breach exposed names, Social Security numbers, financial account information, health insurance data, and medical records. The consolidated case—In re American Renal Management LLC Data Breach Litigation in the U.S. District Court for the Middle District of Tennessee—alleged the defendant failed to implement reasonable cybersecurity measures and unreasonably delayed breach notifications. The settlement, reached through mediation, allocates funds for attorney fees, administration costs, and class member benefits of up to $5,000 for documented losses or approximately $100 per person in pro rata payments. Claims deadline is December 21, 2026, with final fairness hearing scheduled for February 1, 2027. (Source: HIPAA Journal)

Sonic Healthcare, Aurora Diagnostics, Clinical Pathology Laboratories and Austin Pathology Associates agreed to a $6.4 million class action settlement to resolve claims surrounding a 2019 data breach linked to the American Medical Collection Agency (AMCA). According to the lawsuit filed in U.S. District Court for the District of New Jersey (Case No. 19-MD-2904), plaintiffs alleged the healthcare providers failed to take reasonable measures to protect patient data, exposing individuals to fraud and identity theft risks. The defendants did not admit wrongdoing but settled the matter. Class members can receive up to $5,000 for documented out-of-pocket losses or a $50 alternative payment, plus two years of free medical information monitoring. The final approval hearing is scheduled for January 7, 2027, with the claim deadline set for January 4, 2027. (Source: Top Class Actions, October 22, 2026)

Ultra Security, a Birmingham, Michigan-based cybersecurity startup founded by Chase Lee (former CEO of Trustpage, acquired by Vanta), has raised $10 million in seed funding from investors including Ludlow Ventures, Hidden Capital, Entrée Capital, Detroit Venture Partners, firedrop, and FDVC. The company has developed an agentic security platform designed to protect autonomous AI systems through real-time visibility, governance, and protection capabilities that monitor tool calls, data access requests, and prompts. Ultra's platform operates between AI agents and Model Context Protocol servers, offering guardrails, governance, observability, and connectivity features with a local-first architecture. The company has achieved SOC 2 Type II, ISO 27001, ISO 42001 certifications and AARM Extended conformance, with alignment to NIST AI Risk Management Framework; it has also completed a FedRAMP 20x Class B audit and is pursuing full FedRAMP certification (Pulse2).