The New York attorney general (AG) has reached a settlement over a medical data breach that affected 13.3 million people after basic security failures.

Perry Johnson & Associates (PJ&A) and four related companies have agreed to pay $300,000 and implement extensive security reforms following a breach that exposed personal and medical information belonging to more than 13.3 million people. They face another $9.7 million in penalties if they fail to meet the settlement’s terms.

New York AG Letitia James announced the agreement on November 6, alongside the attorneys general of Connecticut, Michigan, and New Jersey. Approximately 4.2 million of the people affected were New York residents.

The investigation describes a series of failures: remote access without multifactor authentication, nearly identical passwords circulated by email, sensitive files without file-level encryption, and security software that detected malicious activity but did not alert security staff.

The result: the companies only discovered the attack when the attackers contacted them on May 2, 2023, and demanded payment.

How many people were affected?

The stolen database files contained records associated with more than 13.3 million people, including approximately 4.2 million New Yorkers.

Earlier reporting put the number of affected patients at approximately 8.95 million. The settlement documents now give the larger figure of more than 13.3 million. The total could be higher, since the AG found that attackers also accessed files in shared network storage containing personal and health information, but the companies did not review those files to identify additional affected people.

The information included:

• Names, dates of birth, and home addresses.
• Social Security numbers.
• Medical record and hospital account numbers.
• Insurance information.
• Admission diagnoses and dates of treatment.
• Clinical information from medical transcriptions, including test results, medications, treatment facilities, and healthcare providers.

---

---

Notifications were also slow. PJ&A began contacting clients about the stolen database files in July 2023, and its clients notified affected individuals between October 31, 2023, and February 8, 2024. The New York AG found that the companies violated state requirements to disclose a breach as quickly as possible and without unreasonable delay.

The settlement

Although the announcement describes a settlement worth up to $10 million, the companies must pay $300,000 in penalties to the states. The remaining $9.7 million is suspended and could become payable. New York will receive $100,000 from the initial payment. These are payments to the states, not an announced compensation payout to patients.

The exposed information could be valuable to criminals. Our research found stolen identity packages selling for as little as 95 cents apiece on the dark web.

The settlement also requires extensive security changes for the relevant active companies, including:

• MFA for individual user accounts, including administrator accounts, and remote network access.
• Stronger password management and access restricted to what employees need for their jobs.
• Encryption of personal and protected health information.
• Monitoring that automatically alerts security personnel to suspicious activity.
• Annual risk assessments and penetration testing.
• Network segmentation and measures to detect and prevent unauthorized data transfers.
• Written incident response procedures and clearer rules for retaining and securely disposing of sensitive information.

Given the carelessness, number of exposed records and people, do you think the companies got off cheap? Let us know in the comments.

How to stay safe

A breach does not automatically mean someone has misused your information, but you can take these precautions while you wait for more details:

• Verify unexpected messages independently. Don’t let a message about the breach rush you into clicking a link, sharing sensitive information, or making a payment. Go to your healthcare provider or insurer’s official website yourself or use contact details you already trust.
• Review medical bills and insurance statements. Look for appointments, tests, prescriptions, or services you did not receive. The Federal Trade Commission (FTC) identifies unfamiliar medical bills and unexpected items on an Explanation of Benefits statement, which explains how your insurer processed a claim, as warning signs of medical identity theft. Report discrepancies to your healthcare provider and your insurer.
• Review your credit reports. Look for unfamiliar accounts or debts and dispute errors. Free reports are available through AnnualCreditReport.com.
• Act if you find signs of identity theft. Visit IdentityTheft.gov for a recovery plan. If someone has received care in your name, ask the providers involved for copies of your medical records and request corrections in writing.

Medical identity theft is not just a financial problem; it can also affect your care. Someone using your identity to obtain treatment or submit insurance claims could introduce incorrect information into your health records. Checking medical statements and reporting anything unfamiliar can help you catch that misuse.

---

Let’s face it, an incognito window can only do so much. 
 
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.