13.3 million people’s medical data exposed in settlement with companies

New York AG settles with Perry Johnson & Associates for $300,000 over breach exposing 13.3M medical records, with $9.7M more at risk if terms unmet.

The New York attorney general reached a settlement with Perry Johnson & Associates and four related companies over a breach exposing personal and medical information for more than 13.3 million people. Approximately 4.2 million of those were New York residents. The companies agreed to pay $300,000 and implement extensive security reforms; they face another $9.7 million in penalties if they fail to meet the terms. The investigation found failures including remote access without multifactor authentication, nearly identical passwords, unencrypted sensitive files, and inadequate alerting. The companies discovered the attack only after the attackers contacted them on May 2, 2023, demanding payment. The stolen files contained names, dates of birth, addresses, social security numbers, medical record numbers, insurance information, diagnoses, and clinical details. Notifications to affected individuals began in July 2023 and continued into early 2024, violating state requirements for timely disclosure.