Perry Johnson & Associates settles with four state AGs over 2023 breach exposing 13.3 million people's medical data

Linha do tempo

1. malwarebytes.com ↗ · pub. 09/11/2026 10:13 · coletado 09/11 12:01

   Perry Johnson & Associates settles with four state AGs over breach exposing 13.3 million people's medical data

   ler a análise desta fonte ocultar

   The New York Attorney General has reached a settlement with Perry Johnson & Associates (PJ&A) and four related companies over a breach that exposed records of more than 13.3 million people, about 4.2 million of them New Yorkers. The agreement, announced November 6 alongside the attorneys general of Connecticut, Michigan and New Jersey, requires $300,000 in payments to the states, with a further $9.7 million suspended and payable if the companies fail to meet its terms. The intrusion dates to 2023: the companies learned of it only when the attackers contacted them on May 2, 2023 and demanded payment. The AG found that the companies breached state requirements to disclose the incident as quickly as possible, since clients notified individuals between October 31, 2023 and February 8, 2024. No new vulnerability or active campaign is reported, so the urgency for defenders is medium, driven by the scale of the exposed data and the possibility that the count is higher.

   Technical Details

   • Remote access was possible without multifactor authentication, and nearly identical passwords circulated by email (per the article).
   • Sensitive files were stored without file-level encryption. Becker's reports that attackers harvested passwords and accessed unencrypted files containing personal and protected health information (beckershospitalreview.com).
   • Security software detected malicious activity but did not alert security staff. Becker's reports that software used by affiliate Perry Johnson Inc. recorded the attackers' activity (beckershospitalreview.com).
   • Exposed data includes names, dates of birth, home addresses, medical record and hospital account numbers, admission diagnoses, dates of treatment, and clinical information from medical transcriptions, such as test results, medications, treatment facilities and providers.
   • Attackers also reached shared network storage holding personal and health information. The companies did not review those files, so the affected total could be higher.

   Remediation

   The settlement requires the companies to deploy MFA for all user accounts, including administrators and remote access; to strengthen password management and enforce least privilege; to encrypt personal and protected health information; to run monitoring that automatically alerts security personnel; to perform annual risk assessments and penetration tests; to segment the network and detect unauthorized data transfers; and to maintain written incident response procedures and secure retention and disposal rules.

   Affected individuals should verify any unexpected breach message independently through the provider's own website or known contact details, review medical bills and Explanation of Benefits statements for services not received, check credit reports through AnnualCreditReport.com, and follow the recovery plan at IdentityTheft.gov if misuse appears. A breach alone does not confirm misuse of personal information.

   Conflicting Reports

   • Earlier reporting put the number of affected patients at approximately 8.95 million, according to the article. The settlement documents give more than 13.3 million, which is the more recent figure.
   • The article states the companies must pay $300,000 in penalties to the states. Becker's describes it as at least $300,000 in penalties and costs (beckershospitalreview.com). The article's figure is used here, since the settlement documents are the primary source and the article describes them directly.
2. hipaajournal.com ↗ · pub. 09/11/2026 11:55 · coletado 09/11 12:00 primeiro registro

   PJ&A to Pay Up to $10 Million in Multi-State Settlement Over 2023 Breach That Exposed 13.3 Million Records

   ler a análise desta fonte ocultar

   Perry Johnson & Associates, Inc. (PJ&A), a medical transcription, coding and billing provider, and four related companies agreed to a settlement of up to $10 million with a coalition of state attorneys general over a March 2023 breach. Only $300,000 is payable now, and the remaining $9.7 million is suspended and becomes due only if the companies fail to meet the agreement (portal.ct.gov). The intrusion exposed electronic protected health information of approximately 13.3 million individuals. The investigation found violations of the HIPAA Security Rule, including the absence of a HIPAA risk analysis, weak control over subcontractors, a further 16 Security Rule violations, and breaches of New York GBL §§ 899-aa and 899-bb. Criticity is medium: the intrusion is over, no CVE or active exploitation is reported, and the remaining exposure is regulatory and reputational, with lessons for other business associates.

   Technical Details

   • Initial access: the threat actor used the credentials of a PJ&A coding employee to log in to an account without multifactor authentication. The attorney general's office states that PJ&A did not require MFA for remote access to its systems (portal.ct.gov).
   • Timeline: the forensic investigation dates first access to March 27, 2023, and the exfiltration of database files to April 7 to April 19, 2023. The intrusion was detected on May 2, 2023, when the attackers began contacting PJ&A employees directly.
   • Persistence and lateral movement: the attacker harvested passwords over several months to reach additional resources.
   • Monitoring gap: security software recorded the unauthorized activity but was not configured to generate alerts, so the intrusion went unnoticed until the attackers made contact.
   • Extortion: a ransom was demanded to prevent publication of the stolen data. When it was not paid, the data was leaked.
   • Data exposed: names, addresses, dates of birth, Social Security numbers, diagnoses, health insurance information, and transcription content including lab results and medications. The exfiltrated files were unencrypted.
   • Compliance failures: PJ&A ran general risk assessments but no HIPAA risk analysis, and did not evaluate its administrative, technical or physical safeguards against Security Rule requirements. Subcontractors had technical access to systems holding ePHI without contractual confidentiality duties or required safeguards.

   Remediation

   The settlement obliges PJ&A and the four companies to maintain a comprehensive information security program and an incident response protocol, with multifactor authentication, password management, data encryption and asset management safeguards. They must also set policies governing the collection, use, retention and disposal of personal health information, and conduct annual risk assessments consistent with the HIPAA Rules (portal.ct.gov). For defenders, the case points to three controls: MFA on all remote and privileged access, alerting enabled on logging and endpoint tools, and contractual security obligations for subcontractors with ePHI access.