US enforcement roundup — October 7, 2026

A plain-English look at recent US cyber and data-security enforcement — FTC orders, state attorney-general settlements, and HHS OCR HIPAA resolutions — and what a small business should learn from each. The mistakes repeat, and the fixes are cheap.

This is the first edition, so the window is the last few months rather than “since the previous file.” Three cases, three different enforcers, one pattern: the thing that went wrong was ordinary, and the thing the order then required is something a café or a clinic can do this week. A settlement resolves an investigation by agreement; it is not a court finding of fault. The lesson is what the agency said went wrong, and what it then made the organization do.

1. 44 attorneys general to Labcorp: you cannot outsource the duty to protect patient data

On September 24, 2026, a bipartisan coalition of 44 state attorneys general announced a settlement with Laboratory Corporation of America (Labcorp) over the 2019 breach at its debt collector, Retrieval-Masters Creditors Bureau, which did business as American Medical Collection Agency (AMCA). The AMCA incident potentially exposed the personal information of more than 27.5 million people nationwide, including 10.2 million Labcorp patients. The states had already settled with AMCA itself in 2021 after its bankruptcy petition was dismissed, with a $21 million payment that was suspended because of that bankruptcy.

This settlement is with the customer of the vendor, not the vendor. Labcorp will pay the states $2,287,455, and the assurance of voluntary compliance is built around vendor management: an incident-response plan that includes internal reporting of vendor security events; minimizing what is shared with vendors; a dedicated vendor-risk team with tools to evaluate vendors and verify they comply; extra rules for debt collectors (contract inventories, cybersecurity standards in the contract, data segmentation, audits, and a right to terminate for non-compliance); and a third-party assessor focused on vendor risk. Colorado Attorney General Phil Weiser put the point in one sentence: “While companies can contract with vendors, they cannot shift data security legal obligations to a contractor or third party.” Separately, Labcorp has agreed a $35 million class-action settlement over the same incident, which the states’ notices describe as still ongoing against other AMCA clients — that is private litigation, not this AG action, and the two figures should not be added together.

What your business should learn: If a processor, a payroll firm, a billing company or a debt collector holds your customers’ data, their breach is treated as yours. The cheap version of what 44 attorneys general just required of a national lab: write down every vendor that holds personal data, what they hold, and how you would hear about a problem. Put in the contract that they must tell you promptly, that you can ask how they protect the data, and that you can walk away if they don’t. Send them less than you currently do — a collector often does not need a full medical or customer file to send a bill. Then pick one afternoon this quarter and actually ask your two riskiest vendors what would happen if they were hit tomorrow. The security baseline check is the place to see which of those vendor and access questions you can already answer; the breach-notification clock is the place to see who you would have to tell, and by when, in every state your customers live in.

2. One phishing email, 225,370 people, and the same first question OCR always asks

On September 17, 2026, HHS Office for Civil Rights (OCR) announced a settlement with Ambry Genetics Corporation, a California genetic-testing and clinical-genomics lab. In January 2020 an employee’s email account was compromised by a phishing attack. The protected health information of 225,370 individuals was potentially taken — names, addresses, dates of birth, some Social Security or driver’s-license numbers, financial information, diagnoses, lab results, medications and treatment information. Ambry reported the breach to HHS in March 2020. OCR’s investigation found potential Security Rule violations in three places: no accurate and thorough risk analysis of the electronic protected health information Ambry held; no procedures to turn off access when a workforce member left or no longer needed it; and no unique user identifier on systems that held that information, so activity could not be tied to a person. Ambry paid $700,000 and agreed a two-year corrective action plan: do the risk analysis, write a risk-management plan, put unique user IDs on every system that holds ePHI, and train the workforce on the Security Rule policies.

OCR Director Paula M. Stannard’s line is the one to keep: “Email phishing is a common cyberattack that can lead to a breach of PHI and reveal HIPAA Security Rule deficiencies.” The attack was not exotic. What the investigation then found was the foundation missing — the risk analysis the Security Rule has required for years, named accounts, and a leavers process. A settlement is an agreement to resolve an investigation, not a court finding that Ambry violated the Rule; the useful content is what OCR said was missing.

What your business should learn: If HIPAA reaches you — as a clinic, a dentist, a billing firm, a lab, or the IT provider sitting behind one — start with the risk analysis, not with a tool. Write down where patient information lives (email included), who can open it, and what you would do if that mailbox were phished tomorrow. Named accounts, not a shared password, on anything that holds that data, and turn access off the day someone leaves — both of those were on OCR’s list here, and both are free. MFA on email is the control that makes the phishing email in this case much harder to cash. First, check whether HIPAA applies to you; if it does, the duties of the rule in force start with that risk analysis. The security baseline asks the same MFA and access questions in insurer language, for everyone.

3. The FTC’s Illuminate order: keep less, say how long you keep it, and mean the breach timeline you publish

On June 5, 2026 the Federal Trade Commission gave final approval to an order against Illuminate Education, Inc., an education-technology vendor, settling allegations that its data-security failures led to a breach in December 2021–January 2022 in which a hacker obtained personal data of 10.1 million students — email and mailing addresses, dates of birth, student records and health-related information. The FTC also alleged Illuminate failed to notify schools about the breach in a timely manner, as it had promised. After a public-comment period the Commission modified the order in two ways that matter more than the headline number: Illuminate must delete personal information it does not reasonably need to provide the product, and must not collect or keep data beyond that; and it must publish and follow a retention schedule that says why each category is collected and when it is deleted. It must also run a comprehensive information-security program and stop misrepresenting its security or how fast it will notify schools and students of a breach.

This is an FTC Act case, not a school-privacy statute, and the order is injunctive — a program, a deletion duty, a public schedule — rather than a dollar penalty in the press notice. The mechanism the complaint describes is a vendor holding more student data than the product required, on cloud databases, and then being unable to keep the notification promise it had made to the schools. The final order’s extra bite, added after comment, is data minimization written as a rule: if you do not need it to deliver the service, delete it, and say so in public.

What your business should learn: The data you still hold is the data you have to protect. A mailing list from 2019, old student or customer records, a backup of a tool you no longer use — each one is in scope the day something goes wrong. Write a one-page retention list: what you collect, why, and when it is deleted; then actually delete a folder this month. Second, only promise a breach timeline you can keep. If your privacy notice, a school contract, or a customer terms page says “we will notify you within X days,” that sentence is now something the FTC will read against the clock. Check what you have already published before you have to use it. The security baseline covers the program and the encryption question; if you are a non-bank financial firm the FTC Safeguards Rule check is the version of this order written as nine elements, including the 30-day FTC notice for incidents affecting 500 or more consumers.

Sources

• Colorado Attorney General — $2.3M national settlement with Labcorp over AMCA data breach, September 24, 2026
• Pennsylvania Office of Attorney General — multistate settlement with Labcorp over the AMCA data breach, September 24, 2026
• HHS OCR — settlement with Ambry Genetics after a phishing attack affecting 225,000 individuals, September 17, 2026
• HHS OCR — Ambry Genetics resolution agreement and corrective action plan (PDF)
• HHS OCR — resolution agreements index
• FTC — final approval of order against Illuminate Education over students’ personal data, June 5, 2026
• FTC — Illuminate Education, Inc., In the Matter of (docket C-4833)