Skip to Content
Colorado Attorney General

Phil Weiser

Colorado Attorney General

File A Complaint
  • About Us
    • Attorney General Bio & Photos
    • Vision & Values
    • Senior Staff & Organization
    • Colorado Attorney General Annual Report
    • Attorney General Opinions
    • Contact Our Office
  • Sections
    • Administration
    • Business & Licensing
    • Civil Litigation & Employment Law
    • Consumer Protection
    • Criminal Appeals
    • Criminal Justice
    • Natural Resources & Environment
    • Division of Community Engagement
    • Revenue & Utilities
    • State Services
  • Careers
    • Attorney & Other Non-Classified Positions
    • Fellowships
    • Internships
    • Classified Staff Positions
    • Other Opportunities to Join our Team
  • Media Center
    • Press Room
    • Colorado Open Records Act – CORA
  • Resources
    • Survivors of Childhood Sexual Abuse
    • Victim Assistance
    • Budget & Accounting
    • Colorado Privacy Act
    • Code of Colorado Regulations
    • Colorado Revised Statutes
    • Coronavirus Information
    • Data Protection Laws
    • Funding Opportunities
    • Office of Financial Empowerment
    • Student Loans
    • Transparency Online Project (TOPS)
  • Licensing
    • Business Resources
    • Collection Agencies & Debt Collectors
    • Colorado Uniform Consumer Credit Code: Licensing & Notification
    • Debt Management Services Providers
    • Health Club Bonds
    • Repossessors
    • Student Loan Servicers: Licensing
    • Telemarketing
  • Recursos en español

Attorney General Phil Weiser announces multistate settlement in data breach that exposed the personal information of tens of thousands of Coloradans

March 11, 2021 (DENVER)—Attorney General Phil Weiser today announced that Colorado, as part of a coalition of 41 attorneys general, has concluded a multistate investigation into a 2019 data breach that exposed the personal information of over 7 million people, including 148,892 Colorado residents.

Retrieval-Masters Creditors Bureau is a debt collection agency. Under the name American Medical Collection Agency, or AMCA, the company specialized in small balance medical debt collection primarily for laboratories and medical testing facilities. An unauthorized user gained access to AMCA’s internal system from Aug. 1, 2018, through March 30, 2019.  AMCA failed to detect the intrusion, despite warnings from banks that processed its payments. The unauthorized user was able to collect a wide variety of personal information, including Social Security numbers, payment card information, and, in some instances, names of medical tests and diagnostic codes.

“Companies must take seriously their responsibility to protect consumers’ personal information,” said Weiser. “Failure to do so can have life-altering consequences for people who may not know they were exposed to potential identity theft. We will continue to hold businesses accountable for protecting Coloradans’ personal information.”

On June 3, 2019, AMCA provided notice to many states and began providing notice to over 7 million affected individuals that included an offer of two years of free credit monitoring. On June 17, 2019, because of the costs associated with providing notification and remediating the breach, AMCA filed for bankruptcy. The multistate coalition participated in all bankruptcy proceedings through the attorneys general of Indiana and Texas. The company ultimately received permission from the bankruptcy court to settle with the multistate, and on December 9, 2020, filed for dismissal of the bankruptcy.

As part of the settlement, AMCA may be liable for a $21 million total payment to the states. Because of AMCA’s financial condition, that payment is suspended unless the company violates certain terms of the settlement agreement.

Under the terms of the settlement, AMCA agreed to implement and maintain a series of data security practices designed to strengthen its information security program and safeguard the personal information of consumers.

Colorado law requires certain persons and entities to take reasonable steps to protect personal identifying information. For more information about Colorado’s data protection laws, go to coag.gov/resources/data-protection-laws/.

###

Media Contact
Lawrence Pacheco
Director of Communications
(720) 508-6553 office | (720) 245-4689 cell
Lawrence.pacheco@coag.gov

Most Recent

State of Colorado to SCOTUS: State anti-discrimination law regulates business sales, not speech

Businesses offering goods and services to the public must serve all and not discriminate Aug. 12, 2022 (DENVER)—The Colorado Attorney General’s Office today asked the U.S. Supreme Court to uphold the state’s long-standing civil rights law that requires public businesses […]

Safe2Tell sees continued decrease in report numbers due to summer break

Aug. 9, 2022 (DENVER)—Safe2Tell report volume decreased 22% last month when compared to June, according to the monthly report released today. Historically, the program records significant decreases in report numbers when students are on summer break. In July, the program received 349 […]

Attorney General Phil Weiser charges Morgan County contractor with felony theft in pole barn construction investigation

Aug. 3, 2022 (DENVER)—The statewide grand jury indicted Jeremy Carter, 42, of Fort Morgan on 33 counts of felony theft for allegedly taking payments from clients throughout Colorado to build pole barns and failing to complete the projects, Attorney General […]

Office of the Attorney General
Colorado Department of Law
Ralph L. Carr Judicial Building
1300 Broadway, 10th Floor
Denver, CO 80203

(720) 508-6000

Contact the Office of the Attorney General

Contact

Facebook
Twitter