AMCA Sonic Healthcare Data Breach Settlement

People who were sent an AMCA breach notice by Clinical Pathology Laboratories or Austin Pathology Associates may claim from a $6,438,578.20 settlement with Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc. and Austin Pathology Associates. The case resolves claims over the cybersecurity incident that American Medical Collection Agency — a billing collections agency the labs used — reported as affecting its computer systems between approximately August 1, 2018 and March 30, 2019. Four things are worth getting straight before you file. First, the class is narrower than the notice's own cover page. That page asks whether you received diagnostic services from all four companies, but the class definition covers only people to whom CPL or Austin Pathology Associates — or AMCA on their behalf — sent a breach notice. Using a Sonic Healthcare or Aurora Diagnostics lab without receiving that notice does not qualify you. Second, this is not the Labcorp AMCA settlement. That was a separate $35,000,000 settlement in the same federal case, and its claim deadline passed on September 3, 2026. Both are reached through the same hub website, so it is easy to open the wrong one — this settlement's toll-free number is (833) 453-3715. Third, the cash options are either-or, but the monitoring stacks. The claim form says to select one: the Alternative Cash Payment, or up to $5,000 in documented Out-of-Pocket Losses. On top of whichever you pick, you may add two years of CyEx Medical Shield Pro medical data monitoring — free, but only if you check its box. Fourth, the $50 is an estimate, not a payment. It is the residual: the fund left after fees of up to 34% (about $2.19 million), administration, service awards, taxes, the monitoring product and all documented-loss claims, divided evenly among everyone who filed for it — so it can land above or below $50. The $5,000 caps one benefit per person, not the settlement, and inside it the lost-time component is separately capped at 10 hours at $25 an hour, a maximum of $250. One deadline note: opting out or objecting closes December 3, 2026, a month before the January 4, 2027 claim deadline.

Do I Qualify?

You may be eligible if:

• Clinical Pathology Laboratories (CPL), or AMCA on CPL's behalf, sent you notice that your information was or may have been involved in the AMCA Security Incident — OR Austin Pathology Associates, or AMCA on its behalf, sent you that same kind of notice. Those two groups are the entire class
• It is the notice that matters, not the lab you visited. Sonic Healthcare U.S.A. and Aurora Diagnostics LLC are Defendants here, but they are not notice channels in the class definition. The court-authorized notice's cover page asks about all four companies, which reads broader than the class actually is
• This is NOT the Labcorp AMCA settlement. That was a separate $35,000,000 settlement in the same MDL for people whose information Labcorp sent to AMCA, and its claim deadline was September 3, 2026. Different fund, different class, different claim form
• Any US state. The class definition has no state restriction and benefits do not vary by state, though CPL and Austin Pathology Associates are Texas-based laboratories
• You do NOT need to have lost any money. The Alternative Cash Payment requires no documentation at all — just a sworn claim form — and the two years of monitoring requires none either. Documentation is needed only if you claim Out-of-Pocket Losses instead
• But you DO have to choose between the two cash options. The Claim Form says "Select one (1)": the Alternative Cash Payment, or Out-of-Pocket Losses up to $5,000
• You can add the monitoring to either option, and it does not reduce your cash — but it has its own checkbox and is not automatic
• You can still file without your notice, by mail. The Claim Form asks for the Notice ID Number only "if known"; the online portal is the route that asks for a Class Member ID to log in
• You are not in an excluded group. The exclusions are narrow: Defendants and their officers and directors, the Judge and Magistrate assigned to evaluate the settlement's fairness, and anyone criminally responsible for the incident
• You file a valid Claim Form by January 4, 2027 — online by that date, or mailed with a postmark no later than that date. December 3, 2026 is the separate, earlier deadline to opt out or object

What you have to prove depends entirely on which cash option you pick, and the two routes are very different. The Alternative Cash Payment requires no documentation. You submit a Claim Form and swear under penalty of perjury that the information in it is true and correct to the best of your knowledge. No receipts, no bank statements, no proof of loss. The two years of CyEx Medical Shield Pro monitoring requires no documentation either — just the checkbox in Section III of the Claim Form. Only the up-to-$5,000 Out-of-Pocket Losses route needs records. What counts as documentation. The losses must be unreimbursed, actually incurred, and fairly and reasonably traceable to the AMCA Security Incident, and you must attest that they were not incurred due to some other event or reason. The notice is explicit that documents which are "self-prepared" by the claimant — handwritten receipts being the example given — are by themselves insufficient to receive reimbursement, though they can add clarity or support to other documentation you submit. Third-party records are what the settlement contemplates: receipts, bills, bank statements. The Claim Form asks you to fill in a chart listing each cost type, the approximate date of the loss, the amount, and a description of the documentation provided. The lost-time component is documented, not attested. Up to 10 total hours at $25 per hour is available for time spent remedying fraud, identity theft or other similar misuse of your personal information fairly traceable to the incident — but the notice calls for verified and documented time. This is stricter than settlements that pay attested hours on your word, and it caps that component at $250. The Notice ID is a soft gate, not a hard one. The Claim Form asks for your "Notice ID Number, if known." Those two words are what separates this settlement from the ID-locked ones: a class member who no longer has the notice can still complete and mail the paper form. The online portal is the stricter route, opening with a login that asks for the Class Member ID from your notice. If your notice is gone, call Kroll Settlement Administration at (833) 453-3715 or use the mail route — and note that the Claim Form offers electronic payment only to claims filed online, so mailing generally means waiting for a check. Everything is verifiable and nothing is final on submission. Claims are subject to verification, and the Settlement Administrator or the Claims Referee may ask you for supplemental information before your claim is considered complete and valid. Why the no-proof option is the safer pick for most people. If your only cost from this breach was worry and time you cannot document with third-party records, the documented route is a gamble while the Alternative Cash Payment is not. Just be clear-eyed that the Alternative Cash Payment is an estimate of roughly $50, calculated as a residual share of what is left in the fund, not a fixed sum.

What Happened?

American Medical Collection Agency — Retrieval-Masters Creditor's Bureau Inc., doing business as AMCA — was a billing collections agency that medical laboratories used to pursue amounts owed by patients. To do that work, the labs transmitted patient information to AMCA.

AMCA reported a cybersecurity incident affecting its computer systems between approximately August 1, 2018 and March 30, 2019. Because the exposure sat with the collections agency rather than with any one lab, it reached patients across multiple laboratory companies, which is why the litigation was organized by lab rather than by breach.

The settlement agreement defines "Personal Information" as names, dates of birth, Social Security numbers, addresses, credit card information, bank information, or medical provider-related information that Plaintiffs contend could potentially have been accessed without authorization as a result of the Security Incident. Not every class member's records contained every category.

The lawsuits were consolidated as In re: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation, No. 19-md-2904 (JKS)(MAH), MDL 2904, in the U.S. District Court for the District of New Jersey, before Judge Jamel K. Semper. The MDL has been resolved in tracks. An earlier $35,000,000 settlement covered the Labcorp defendant and closed to claims on September 3, 2026. This settlement is the Other Labs Track settlement with Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc. and Austin Pathology Associates, who provide diagnostic testing and formerly used AMCA.

Defendants agreed to fund a $6,438,578.20 non-reversionary common fund. The Court granted preliminary approval on August 20, 2026. Settlement Class Counsel are James E. Cecchi of Carella, Byrne, Cecchi, Brody & Agnello, P.C.; Joseph J. DePalma of Lite DePalma Greenberg & Afanador, LLC; and Justin J. Hawal of DiCello Levitt LLP. Class members are not charged for these lawyers; counsel will ask the Court for fees and expenses of up to 34% of the fund, plus Service Awards for the named Plaintiffs, all paid from the fund. Kroll Settlement Administration is the Settlement Administrator and CyEx is the Court-appointed provider of the monitoring services.

Defendants deny all claims alleged against them and deny all charges of wrongdoing or liability. The notice states that the Court did not decide in favor of Plaintiffs or Defendants, and that the settlement is not an admission of wrongdoing.

The Final Fairness Hearing is scheduled for January 7, 2027 at 11:00 a.m. ET before Judge Semper at the Frank R. Lautenberg U.S.P.O. & Courthouse, 2 Federal Square, Newark, NJ 07102, in Courtroom PO 03. The notice says the date and time may change. Benefits are distributed only if the Court grants final approval and after any appeals are resolved or the time to appeal has expired.

How to File Your Claim

1. START AT THE COURT-APPROVED SETTLEMENT WEBSITE — WWW.AMCADATABREACHSETTLEMENT.COM. That is the address printed on every page of the Long Form Notice, and the documents page is www.amcadatabreachsettlement.com/documents. The site is run by Kroll Settlement Administration
2. WATCH WHICH SETTLEMENT YOU CLICK — THAT ADDRESS SERVES TWO OF THEM. The website is the hub for the whole AMCA litigation and links out to each settlement in it. One of those links is the Labcorp AMCA settlement, whose claim deadline was September 3, 2026 and is closed
3. the one you want is the Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc. and Austin Pathology Associates settlement, which the hub links to on its own Sonic settlement page (address amcadatabreachsettlement-saca.com). The two settlements have different funds, different classes, different claim forms and different toll-free numbers — this one's number is (833) 453-3715, and if the page you are on shows a different one you are on the wrong settlement. Navigate from the hub if you are unsure
4. FILE ONLINE OR BY MAIL — BOTH ROUTES ARE OPEN. The notice says the fastest way is online through the settlement website. You can also download the Claim Form from the website and mail it, with any supporting documentation, to: American Medical Collection Agency, Inc. Customer Data Security Breach Litigation Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc., and Austin Pathology Associates Settlement, Attn: Claims, c/o Kroll Settlement Administration LLC, PO Box 5324, New York, NY 10150-5324. You can also call (833) 453-3715 to request a paper Claim Form
5. THE NOTICE ID IS NOT A WALL ON THE PAPER ROUTE. The Claim Form filed with the court asks for your "Notice ID Number, if known" — those three words matter. Unlike settlements that gate every route behind a code, a class member who no longer has the notice can still complete and mail the paper form. The online portal is the stricter route: it opens with a login that asks for the Class Member ID from your notice, so if your notice is gone, either call the administrator or use the mail route
6. THE CLAIM DEADLINE IS JANUARY 4, 2027 — online by that date, or mailed with a postmark no later than that date. The notice gives no time of day and no time zone
7. THE EARLIER DEADLINE IS DECEMBER 3, 2026, AND IT IS A MONTH AHEAD OF THE CLAIM DATE. Opting out and objecting both close on December 3, 2026. A request for exclusion must be mailed, personally signed, and postmarked no later than that date, and it must give the case name, your full name, current mailing address and telephone number, your signature, and the words "Request for Exclusion" or an equivalent statement. Opting out is the only route that preserves any right to sue Defendants separately. Note the one inconsistency in the paperwork: the notice says objections must be postmarked by December 3, 2026, while the settlement agreement and the website's dates page say received by that date — treat December 3 as a received-by date to be safe. Objections may also be filed through the court's ECF system
8. PICK ONE CASH OPTION, THEN ADD THE MONITORING. The Claim Form says "Select one (1) of the following options" — the Alternative Cash Payment or reimbursement of Out-of-Pocket Losses. The two years of CyEx Medical Shield Pro monitoring is a separate checkbox in its own section and may be added to either
9. it is not automatic, so if you want it you must check the box
10. IF YOU CLAIM OUT-OF-POCKET LOSSES, BRING THIRD-PARTY RECORDS AND FILL IN THE CHART. The Claim Form has a table asking for cost type, approximate date of loss, amount, and a description of the documentation you are attaching. Self-prepared documents such as handwritten receipts are not enough on their own
11. EVERY CLAIM IS SWORN. You sign under penalty of perjury, your claim is subject to verification, and the Settlement Administrator or Claims Referee may ask for supplemental information before treating the claim as complete and valid
12. QUESTIONS: Kroll Settlement Administration, (833) 453-3715 toll-free, or PO Box 5324, New York, NY 10150-5324. Do not contact the Court or the Clerk of Court about the settlement — the notice says so explicitly.
13. Visit the official claim form: https://www.amcadatabreachsettlement.com/

How Much Will I Actually Get?

THE TWO CASH OPTIONS ARE EITHER-OR; THE MONITORING STACKS ON TOP OF EITHER. The Claim Form filed with the court instructs you to "Select one (1) of the following options": the Alternative Cash Payment, or reimbursement of documented Out-of-Pocket Losses up to $5,000. The settlement agreement describes the Alternative Cash Payment as available "in lieu of seeking Out-of-Pocket Losses." The third benefit behaves differently: the agreement says that "in addition to Out-of-Pocket Losses or Alternative Cash Payment," class members may claim and enroll in up to two years of CyEx Medical Shield Pro medical and healthcare information monitoring. So the realistic best case for most people is the cash payment plus two years of monitoring — not the $50 plus $5,000 plus monitoring. THE $50 IS AN ESTIMATE, NOT A FIXED PAYMENT, AND IT IS THE LAST THING PAID. This is the single most misunderstood number in this settlement. The Alternative Cash Payment is "estimated to be $50 per valid claimant," and the notice explains the mechanics: after Notice and Administration Expenses, Service Awards, Attorneys' Fees and Expenses, Out-of-Pocket Losses and Taxes come out of the Settlement Fund, the remaining Net Settlement Fund is divided evenly among everyone who filed a valid Alternative Cash Payment claim. The settlement agreement's definition of Net Settlement Fund also subtracts the cost of procuring Medical Shield Pro. Both benefit types are expressly "subject to pro rata increases or decreases dependent on the number of claims filed," so the figure can land above or below $50 depending on how many people file and how large the documented-loss claims turn out to be. Note one wrinkle in the paperwork: the Claim Form's checkbox describes the Alternative Cash Payment as "up to $50," while the notice and the agreement describe $50 as an estimate that can rise as well as fall. THE $5,000 CAPS ONE BENEFIT PER PERSON — IT IS NOT THE SETTLEMENT'S VALUE AND NOT A CAP ON THE FUND. The $5,000 ceiling applies per class member to documented Out-of-Pocket Losses only. Qualifying losses must be unreimbursed, actually incurred, and fairly and reasonably traceable to the AMCA Security Incident, and the notice lists what counts: (i) costs, expenses, losses or charges from identity theft or identity fraud, medical fraud, or other alleged misuse of your personal information; (ii) professional service costs such as law firms or credit repair services related to that misuse; (iii) miscellaneous related expenses such as notary, fax, postage, copying, mileage and long-distance telephone charges; (iv) credit monitoring costs incurred on or after August 1, 2018 through the claims deadline; and (v) up to 10 total hours of verified, documented time spent remedying fraud, identity theft or similar misuse, at $25 per hour. THERE IS A SECOND, SMALLER CAP HIDDEN INSIDE THE FIRST. The lost-time component is capped at 10 hours at $25 an hour — a maximum of $250 — and unlike many data breach settlements those hours must be verified and documented, not merely attested. Reaching anything near $5,000 therefore requires real financial loss with real records, not time. OUT-OF-POCKET CLAIMS CAN ALSO BE CUT PRO RATA. The notice states that Out-of-Pocket Losses are subject to increases or decreases pro rata depending on the number of claims filed, so even a fully documented $5,000 claim is not a guaranteed $5,000. DOCUMENTATION STANDARD: THIRD-PARTY RECORDS. Claims for Out-of-Pocket Losses require documentation plus an attestation that the losses are fairly traceable to the Security Incident and were not incurred for some other reason. Receipts and similar records count; documents that are "self-prepared" by the claimant, such as handwritten receipts, are by themselves insufficient, though they can add clarity or support to other documentation. THE FUND IS $6,438,578.20 AND IT IS NON-REVERSIONARY. Nothing goes back to Defendants — as of the Effective Date their rights in the fund are extinguished, except if the settlement is terminated or approval is reversed on appeal. But everything comes out of that one fund, including benefits: Settlement Class Counsel will ask for attorneys' fees and expenses of up to 34% of the fund (about $2.19 million), plus Service Awards for the named Plaintiffs, notice and administration costs, taxes and the cost of the monitoring product — all paid from the fund, which is why the $50 is a residual rather than a promise. NOTHING IS PAID UNTIL THE COURT APPROVES. The Final Fairness Hearing is set for January 7, 2027 at 11:00 a.m. ET before Judge Jamel K. Semper at the Frank R. Lautenberg U.S.P.O. & Courthouse, 2 Federal Square, Newark, NJ 07102, in Courtroom PO 03; the notice says the date and time may change. Benefits are distributed only if the Court grants final approval and after any appeals are resolved or the time to appeal has expired.

Last reviewed: October 8, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions