● Covered by 1 source · 1 reportMedium impact1 neutral
Medical Services Company Settles with Four States Over 2023 Data Breach Affecting 13M Patients
Key points
- Perry Johnson Companies settled with four states for $300,000.
- The 2023 breach exposed data of over 13 million people.
- Hackers gained access via compromised employee credentials; MFA was not used.
- Company security systems failed to flag hacker activity for two months.
Settlement Reached Over Major Data Breach
Perry Johnson Companies, a Nevada-based medical services firm, has reached a settlement with the Attorneys General of Connecticut, New Jersey, New York, and Michigan. The agreement mandates a payment of $300,000 and requires the company to overhaul its cybersecurity practices following a March 2023 data breach that compromised the sensitive information of more than 13 million individuals nationwide.
Details of the Security Lapses
An investigation by the New York Attorney General's office revealed that hackers infiltrated Perry Johnson's systems using an employee's credentials. A critical vulnerability identified was the company's lack of multi-factor authentication (MFA) for user verification. This allowed unauthorized access to persist for two months, during which hackers exfiltrated unencrypted files containing protected health data.
Despite the company's software recording the hacker's movements, it was allegedly misconfigured and failed to alert the information security team. The breach was only discovered when the hackers themselves notified the firm.
Compromised Patient Data
The stolen records included a wide range of personal and medical information. This data encompassed names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance details, and clinical information from medical transcription files. Specific details like medication names, diagnostic results, and lab test results were also compromised.
Mandated Security Reforms
As part of the settlement, Perry Johnson Companies must implement a comprehensive information security program and establish robust incident response standards. Key requirements include the adoption of multi-factor authentication, encryption protocols, and improved password management systems. The company is also required to conduct yearly risk assessments and create a system for managing the collection, use, retention, and disposal of health data. Failure to comply with these reforms could result in an additional $9.7 million payment to the four states.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Perry Johnson Companies, a medical services firm, has agreed to pay $300,000 and implement significant security changes after a March 2023 data breach exposed the data of over 13 million individuals. The settlement with Connecticut, New Jersey, New York, and Michigan addresses the company's failure to use multi-factor authentication and properly monitor its systems, which allowed hackers to access sensitive patient records for two months.