Perry Johnson Companies, a Nevada-based medical services provider, has reached a settlement with the attorneys general of Connecticut, New Jersey, New York, and Michigan regarding a significant data breach that occurred in March 2023. The incident, which affected the company’s medical transcription, coding, and imaging subsidiaries, resulted in the exposure of sensitive personal and health information belonging to more than 13 million individuals across the United States.
Under the terms of the agreement, the firm is required to pay $300,000 to the four participating states. Furthermore, the settlement includes a suspended penalty of $9.7 million, which the company will be forced to pay if it fails to implement a series of mandated cybersecurity reforms.
Investigations conducted by the office of the New York Attorney General determined that the breach originated from the unauthorized use of an employee’s credentials. Officials confirmed that the company did not have multi-factor authentication (MFA) in place at the time of the incident, which allowed the attackers to gain access to the network. Once inside, the unauthorized actors were able to harvest passwords and access unencrypted files containing protected health information.
The investigation revealed that the company’s internal security software had detected the intruders' movements within the system. However, due to poor configuration, the software failed to alert the information security team to the suspicious activity. Consequently, the data exfiltration continued undetected for approximately two months. It is alleged that the company only became aware of the breach after the attackers themselves notified the firm of the intrusion.
The scope of the stolen data was extensive. According to state officials, the compromised files contained a wide range of sensitive information, including full names, home addresses, dates of birth, and Social Security numbers. Additionally, the breach exposed hospital account numbers, insurance details, and clinical data, such as diagnostic results, lab test reports, and lists of medications.
As part of the settlement, Perry Johnson Companies must overhaul its information security infrastructure. The company is now obligated to establish a comprehensive security program that includes the implementation of multi-factor authentication, robust encryption protocols, and updated password management systems.
Beyond technical upgrades, the agreement mandates that the firm adopt formal incident response standards to ensure future threats are identified and mitigated promptly. The company is also required to conduct annual risk assessments to identify potential vulnerabilities within its network.
Finally, the settlement requires the firm to institute new governance policies regarding the lifecycle of patient data. This includes strict protocols for the collection, use, retention, and eventual disposal of health information to ensure that sensitive records are not stored indefinitely or handled insecurely. The company has not provided a public comment regarding the settlement or the findings of the state investigations.
