New York and three other states have reached a settlement with Perry Johnson & Associates and four related companies after a 2023 breach exposed personal and medical information tied to more than 13.3 million people. The agreement requires at least $300,000 in payments to the states and allows regulators to seek another $9.7 million if the companies fail to meet its terms, according to the New York attorney general’s announcement. [1]
The affected companies provided medical coding, billing, recording and transcription services to healthcare organizations. About 4.2 million of the affected individuals were New York residents. The exposed records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, insurance information, diagnoses, laboratory and diagnostic results, and medication details from medical transcription files. The settlement does not announce compensation payments to patients; the money is directed to the participating states.
The incident began in March 2023, when attackers accessed PJ&A systems using credentials belonging to an employee of its coding business. Investigators found that remote access did not require multifactor authentication, while files containing personal and protected health information were not encrypted. Security software recorded the attackers’ activity but was not configured to alert personnel, leaving the companies unaware until the hackers contacted them roughly two months later. The official findings do not identify a CVE, public exploit or threat actor, indicating a credential-and-controls failure rather than a disclosed software vulnerability. [1]
The agreement calls for a comprehensive information-security and incident-response program, multifactor authentication for relevant access, stronger password and asset-management controls, encryption, annual HIPAA-aligned risk assessments, and rules governing the retention and disposal of health information. It also requires affected companies that maintain protected health information to improve their data-handling practices. The New York attorney general said the companies will pay at least $300,000 collectively, with New York receiving at least $100,000; the additional $9.7 million is suspended unless the settlement terms are breached. [1]
People who may be affected should treat unexpected breach-related messages cautiously and contact healthcare providers or insurers through independently verified channels. They should review medical bills and insurance statements for unfamiliar services, examine credit reports for unknown accounts, and report suspected identity theft through IdentityTheft.gov. Medical identity theft can create both financial harm and inaccurate clinical records, making unfamiliar diagnoses, prescriptions or treatment entries worth challenging with the provider and insurer.
