Medical Data Breach Exposed 13.3 Million; Companies Agree to $300,000 Settlement
Summary
A multistate AG investigation found that a breach at Perry Johnson & Associates and related companies exposed data linked to more than 13.3 million people. The settlement requires $300,000 in payments and security reforms, with another $9.7 million suspended.
Key points
- Files contained personal and medical information associated with more than 13.3 million people, including about 4.2 million New Yorkers; the total could be higher because shared-storage files were not reviewed to identify additional affected people.
- Exposed information included Social Security numbers, medical and hospital account numbers, insurance details, diagnoses, treatment dates, and clinical information.
- The investigation cited remote access without MFA, similar passwords shared by email, unencrypted sensitive files, and security software that detected malicious activity but did not alert staff.
- The companies discovered the attack after attackers contacted them on May 2, 2023, and demanded payment.
- The companies agreed to pay $300,000 to the states; a further $9.7 million is suspended and could become payable if settlement terms are not met. The payment is not patient compensation.
- The settlement requires measures including MFA, stronger password controls, encryption, security alerts, risk assessments, penetration testing, network segmentation, and incident-response procedures.
- Notifications to affected individuals occurred between October 31, 2023, and February 8, 2024, after the companies began contacting clients in July 2023.
Article Details
- Victim Organization
- Perry Johnson & Associates (PJ&A) and four related companies
- Incident Type
- Medical data breach involving stolen database files and access to files in shared network storage
- Data Types Exposed
- Names
- Dates of birth
- Home addresses
- Social Security numbers
- Medical record numbers
- Hospital account numbers
- Insurance information
- Admission diagnoses
- Dates of treatment
- Clinical information from medical transcriptions, including test results, medications, treatment facilities, and healthcare providers
- Affected Records
- Records associated with more than 13.3 million people, including approximately 4.2 million New York residents. Additional affected people may be unidentified because files in shared network storage were not reviewed.
- Operational Impact
- The breach exposed personal and medical information. The article does not report operational disruption. The settlement requires security reforms, including multifactor authentication, encryption, monitoring, and incident response procedures.
- Ransom Or Extortion
- Attackers contacted the companies on May 2, 2023, and demanded payment. The article does not state whether a ransom was paid.
- Claim Status
- confirmed