Perry Johnson & Associates settles with four state AGs over breach exposing 13.3 million people's medical data
The New York Attorney General has reached a settlement with Perry Johnson & Associates (PJ&A) and four related companies over a breach that exposed records of more than 13.3 million people, about 4.2 million of them New Yorkers. The agreement, announced November 6 alongside the attorneys general of Connecticut, Michigan and New Jersey, requires $300,000 in payments to the states, with a further $9.7 million suspended and payable if the companies fail to meet its terms. The intrusion dates to 2023: the companies learned of it only when the attackers contacted them on May 2, 2023 and demanded payment. The AG found that the companies breached state requirements to disclose the incident as quickly as possible, since clients notified individuals between October 31, 2023 and February 8, 2024. No new vulnerability or active campaign is reported, so the urgency for defenders is medium, driven by the scale of the exposed data and the possibility that the count is higher.
Detalhes técnicos
- Remote access was possible without multifactor authentication, and nearly identical passwords circulated by email (per the article).
- Sensitive files were stored without file-level encryption. Becker's reports that attackers harvested passwords and accessed unencrypted files containing personal and protected health information (beckershospitalreview.com).
- Security software detected malicious activity but did not alert security staff. Becker's reports that software used by affiliate Perry Johnson Inc. recorded the attackers' activity (beckershospitalreview.com).
- Exposed data includes names, dates of birth, home addresses, medical record and hospital account numbers, admission diagnoses, dates of treatment, and clinical information from medical transcriptions, such as test results, medications, treatment facilities and providers.
- Attackers also reached shared network storage holding personal and health information. The companies did not review those files, so the affected total could be higher.
Remediação
The settlement requires the companies to deploy MFA for all user accounts, including administrators and remote access; to strengthen password management and enforce least privilege; to encrypt personal and protected health information; to run monitoring that automatically alerts security personnel; to perform annual risk assessments and penetration tests; to segment the network and detect unauthorized data transfers; and to maintain written incident response procedures and secure retention and disposal rules.
Affected individuals should verify any unexpected breach message independently through the provider's own website or known contact details, review medical bills and Explanation of Benefits statements for services not received, check credit reports through AnnualCreditReport.com, and follow the recovery plan at IdentityTheft.gov if misuse appears. A breach alone does not confirm misuse of personal information.
Relatos divergentes
- Earlier reporting put the number of affected patients at approximately 8.95 million, according to the article. The settlement documents give more than 13.3 million, which is the more recent figure.
- The article states the companies must pay $300,000 in penalties to the states. Becker's describes it as at least $300,000 in penalties and costs (beckershospitalreview.com). The article's figure is used here, since the settlement documents are the primary source and the article describes them directly.
Linha do tempo
-
Perry Johnson & Associates settles with four state AGs over breach exposing 13.3 million people's medical data
ler a análise desta fonte ocultar
The New York Attorney General has reached a settlement with Perry Johnson & Associates (PJ&A) and four related companies over a breach that exposed records of more than 13.3 million people, about 4.2 million of them New Yorkers. The agreement, announced November 6 alongside the attorneys general of Connecticut, Michigan and New Jersey, requires $300,000 in payments to the states, with a further $9.7 million suspended and payable if the companies fail to meet its terms. The intrusion dates to 2023: the companies learned of it only when the attackers contacted them on May 2, 2023 and demanded payment. The AG found that the companies breached state requirements to disclose the incident as quickly as possible, since clients notified individuals between October 31, 2023 and February 8, 2024. No new vulnerability or active campaign is reported, so the urgency for defenders is medium, driven by the scale of the exposed data and the possibility that the count is higher.
Technical Details
- Remote access was possible without multifactor authentication, and nearly identical passwords circulated by email (per the article).
- Sensitive files were stored without file-level encryption. Becker's reports that attackers harvested passwords and accessed unencrypted files containing personal and protected health information (beckershospitalreview.com).
- Security software detected malicious activity but did not alert security staff. Becker's reports that software used by affiliate Perry Johnson Inc. recorded the attackers' activity (beckershospitalreview.com).
- Exposed data includes names, dates of birth, home addresses, medical record and hospital account numbers, admission diagnoses, dates of treatment, and clinical information from medical transcriptions, such as test results, medications, treatment facilities and providers.
- Attackers also reached shared network storage holding personal and health information. The companies did not review those files, so the affected total could be higher.
Remediation
The settlement requires the companies to deploy MFA for all user accounts, including administrators and remote access; to strengthen password management and enforce least privilege; to encrypt personal and protected health information; to run monitoring that automatically alerts security personnel; to perform annual risk assessments and penetration tests; to segment the network and detect unauthorized data transfers; and to maintain written incident response procedures and secure retention and disposal rules.
Affected individuals should verify any unexpected breach message independently through the provider's own website or known contact details, review medical bills and Explanation of Benefits statements for services not received, check credit reports through AnnualCreditReport.com, and follow the recovery plan at IdentityTheft.gov if misuse appears. A breach alone does not confirm misuse of personal information.
Conflicting Reports
- Earlier reporting put the number of affected patients at approximately 8.95 million, according to the article. The settlement documents give more than 13.3 million, which is the more recent figure.
- The article states the companies must pay $300,000 in penalties to the states. Becker's describes it as at least $300,000 in penalties and costs (beckershospitalreview.com). The article's figure is used here, since the settlement documents are the primary source and the article describes them directly.