PJ&A to Pay Up to $10 Million in Multi-State Settlement Over 2023 Breach That Exposed 13.3 Million Records
Perry Johnson & Associates, Inc. (PJ&A), a medical transcription, coding and billing provider, and four related companies agreed to a settlement of up to $10 million with a coalition of state attorneys general over a March 2023 breach. Only $300,000 is payable now, and the remaining $9.7 million is suspended and becomes due only if the companies fail to meet the agreement (portal.ct.gov). The intrusion exposed electronic protected health information of approximately 13.3 million individuals. The investigation found violations of the HIPAA Security Rule, including the absence of a HIPAA risk analysis, weak control over subcontractors, a further 16 Security Rule violations, and breaches of New York GBL §§ 899-aa and 899-bb. Criticity is medium: the intrusion is over, no CVE or active exploitation is reported, and the remaining exposure is regulatory and reputational, with lessons for other business associates.
Detalhes técnicos
- Initial access: the threat actor used the credentials of a PJ&A coding employee to log in to an account without multifactor authentication. The attorney general's office states that PJ&A did not require MFA for remote access to its systems (portal.ct.gov).
- Timeline: the forensic investigation dates first access to March 27, 2023, and the exfiltration of database files to April 7 to April 19, 2023. The intrusion was detected on May 2, 2023, when the attackers began contacting PJ&A employees directly.
- Persistence and lateral movement: the attacker harvested passwords over several months to reach additional resources.
- Monitoring gap: security software recorded the unauthorized activity but was not configured to generate alerts, so the intrusion went unnoticed until the attackers made contact.
- Extortion: a ransom was demanded to prevent publication of the stolen data. When it was not paid, the data was leaked.
- Data exposed: names, addresses, dates of birth, Social Security numbers, diagnoses, health insurance information, and transcription content including lab results and medications. The exfiltrated files were unencrypted.
- Compliance failures: PJ&A ran general risk assessments but no HIPAA risk analysis, and did not evaluate its administrative, technical or physical safeguards against Security Rule requirements. Subcontractors had technical access to systems holding ePHI without contractual confidentiality duties or required safeguards.
Remediação
The settlement obliges PJ&A and the four companies to maintain a comprehensive information security program and an incident response protocol, with multifactor authentication, password management, data encryption and asset management safeguards. They must also set policies governing the collection, use, retention and disposal of personal health information, and conduct annual risk assessments consistent with the HIPAA Rules (portal.ct.gov). For defenders, the case points to three controls: MFA on all remote and privileged access, alerting enabled on logging and endpoint tools, and contractual security obligations for subcontractors with ePHI access.
Linha do tempo
-
PJ&A to Pay Up to $10 Million in Multi-State Settlement Over 2023 Breach That Exposed 13.3 Million Records
ler a análise desta fonte ocultar
Perry Johnson & Associates, Inc. (PJ&A), a medical transcription, coding and billing provider, and four related companies agreed to a settlement of up to $10 million with a coalition of state attorneys general over a March 2023 breach. Only $300,000 is payable now, and the remaining $9.7 million is suspended and becomes due only if the companies fail to meet the agreement (portal.ct.gov). The intrusion exposed electronic protected health information of approximately 13.3 million individuals. The investigation found violations of the HIPAA Security Rule, including the absence of a HIPAA risk analysis, weak control over subcontractors, a further 16 Security Rule violations, and breaches of New York GBL §§ 899-aa and 899-bb. Criticity is medium: the intrusion is over, no CVE or active exploitation is reported, and the remaining exposure is regulatory and reputational, with lessons for other business associates.
Technical Details
- Initial access: the threat actor used the credentials of a PJ&A coding employee to log in to an account without multifactor authentication. The attorney general's office states that PJ&A did not require MFA for remote access to its systems (portal.ct.gov).
- Timeline: the forensic investigation dates first access to March 27, 2023, and the exfiltration of database files to April 7 to April 19, 2023. The intrusion was detected on May 2, 2023, when the attackers began contacting PJ&A employees directly.
- Persistence and lateral movement: the attacker harvested passwords over several months to reach additional resources.
- Monitoring gap: security software recorded the unauthorized activity but was not configured to generate alerts, so the intrusion went unnoticed until the attackers made contact.
- Extortion: a ransom was demanded to prevent publication of the stolen data. When it was not paid, the data was leaked.
- Data exposed: names, addresses, dates of birth, Social Security numbers, diagnoses, health insurance information, and transcription content including lab results and medications. The exfiltrated files were unencrypted.
- Compliance failures: PJ&A ran general risk assessments but no HIPAA risk analysis, and did not evaluate its administrative, technical or physical safeguards against Security Rule requirements. Subcontractors had technical access to systems holding ePHI without contractual confidentiality duties or required safeguards.
Remediation
The settlement obliges PJ&A and the four companies to maintain a comprehensive information security program and an incident response protocol, with multifactor authentication, password management, data encryption and asset management safeguards. They must also set policies governing the collection, use, retention and disposal of personal health information, and conduct annual risk assessments consistent with the HIPAA Rules (portal.ct.gov). For defenders, the case points to three controls: MFA on all remote and privileged access, alerting enabled on logging and endpoint tools, and contractual security obligations for subcontractors with ePHI access.