On November 6, 2026, the attorneys general of New York, Connecticut, Michigan and New Jersey announced a settlement of up to $10 million with Perry Johnson & Associates (PJ&A) and four related companies. The settlement covers a March 2023 breach that exposed personal and health records of about 13.3 million people nationwide, including about 4.2 million New Yorkers, according to the New York Attorney General's office. The $10 million figure is a ceiling rather than the amount due. The companies must pay at least $300,000, and the remaining $9.7 million is suspended. That suspended amount becomes payable only if the companies break the agreement or, according to Beinsure's reading of the terms, if their statements about their finances turn out to be materially false. The Record reported the deal as a $300,000 settlement, while the attorneys general describe it as "up to $10 million." Both are accurate, but they describe different numbers.
What Happened
The New York Attorney General's office led the investigation. It found that attackers got into PJ&A's systems in March 2023 using the login credentials of an employee at PJ&A Coding, a subsidiary. The attackers stayed in the network for about two months. During that time they collected more passwords and reached unencrypted files holding protected health information.
Software run by Perry Johnson, Inc. (PJI) detected and logged the attacker's activity. However, investigators say it was set up so that it never alerted the security team. PJ&A found out about the breach only when the attackers contacted the company themselves, according to the New York Attorney General's office and The Record.
Five companies are named in the settlement: - Perry Johnson & Associates, Inc. - Perry Johnson, Inc. - Perry Johnson & Associates Coding, Inc. - Perry Johnson & Associates Radiology, Inc. - Medical Transcription and Coding, Inc.
PJ&A provided transcription, coding, billing, recording and dictation services to health care organizations across the country. The Record describes the group as Nevada-based.
Details on how the money is split come from the legal analysis site Recording Law, which reviewed the signed agreements, and other outlets: - Payment split: Recording Law reports that New York's nominal share is about $3.33 million, of which roughly $100,000 is actually payable. Connecticut's nominal share is about $2.22 million, of which about $66,666 is payable. - Why most of the penalty is suspended: Recording Law reports that the $9.7 million was suspended because some of the companies said they could not pay. It also reports that four of the five companies were found to be insolvent and inactive, so the required security program binds Perry Johnson, Inc. directly and applies to the others only if they become active again. Neither claim appears in the attorneys general's press releases. - No admission of wrongdoing: Law News, citing the New Jersey agreement, reports that the companies neither admit nor deny the findings. - Company response: The company did not respond to The Record's request for comment.
What Was Taken
The New York Attorney General's office says the stolen records included: - names, dates of birth and home addresses - Social Security numbers - hospital account numbers and insurance information - diagnoses and clinical information from medical transcription files, including lab and diagnostic test results and medication names
All outlets agree on 13.3 million affected people nationwide. The Record puts it more loosely as "more than 13 million." State-level figures were not published beyond New York's 4.2 million. Recording Law reports that the settlement does not set up a compensation fund, a claims process or credit monitoring, so no patient receives money under this deal.
Why It Matters
This is a supplier breach. Patients whose hospitals and practices outsourced transcription and coding had their most sensitive records exposed by a company most of them had never heard of. The investigators' findings also describe three basic failures happening at the same time: - no multi-factor authentication on remote access - unencrypted health records sitting where an intruder could reach them - detection tooling that recorded the attack but never alerted anyone
Better configuration of any one of these could have stopped the breach or caught it early.
The settlement structure is also worth noting. Most of the penalty is suspended, and Recording Law reports that most of the companies are insolvent. Regulators may impose large headline penalties that are never paid, so they do little to make up for a vendor's security failures. Health care organizations cannot rely on enforcement after the fact to protect them from vendor risk.
The Attack Technique
The sequence below is based on the New York Attorney General's findings. No threat actor has been publicly named, and none of the published materials state how the employee's credentials were first obtained.
- Initial access: The attackers logged in with a PJ&A Coding employee's valid credentials. Multi-factor authentication was not required for remote access, so a password alone was enough.
- Credential harvesting: Over the following months, the attackers collected additional passwords to expand their access.
- Data access: They reached unencrypted files containing personal and protected health information.
- Missed detection: PJI's software logged the activity, but because of how it was configured, no alert reached the security team.
- Discovery: The breach came to light about two months after it began, when the attackers contacted the company.
What Organizations Should Do
- Require phishing-resistant MFA on all remote access. This includes contractor, subsidiary and coding-staff accounts. Also require your vendors to prove they do the same, not just state it on a questionnaire.
- Test that your alerts actually fire. Run regular detection tests to confirm that logged suspicious activity, such as unusual logins, credential dumping or bulk file access, reaches a person who will respond.
- Encrypt health data at rest and delete what you don't need. The settlement's retention requirements reflect a simple point: transcription files that no longer exist cannot be stolen.
- Manage passwords centrally and watch for credential harvesting. Use a password manager, rotate privileged credentials, and alert on access to credential stores.
- Audit vendors that handle patient data. Review business associates' access controls, logging and incident response. Write breach notification deadlines and security requirements into contracts.
- Run risk assessments every year. The settlement now requires this of Perry Johnson. It is a sensible baseline for any organization that holds health data.
Sources: Perry Johnson Breach: Up to $10M, 13.3M People 2026 | Medical services company settles with 4 states over 2023 hack of se... | State attorneys general secure up to $10 million and corrective act... | Attorney General James Secures Up to $10 Million and Critical Refor... | Perry Johnson Breach Settlement: $10M Headline, $300,000 Due Recor... | Perry Johnson healthcare data breach: $10 mn settlement over 13.3 m... | New York Attorney General James Secures Up to $10 Million From Perr... | Four US states secure $10m from Perry Johnson companies over 13.3m-...