Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Perry Johnson Settles with States Over 2023 Patient Data Breach

3 sources · 3 articlesFirst reported Updated ()1
What's new

2026-11-09: Malwarebytes Labs adds details on security failures, May 2, 2023 discovery date, and announcement by New York AG.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Perry Johnson Companies agreed to pay $300,000 and security reforms after a 2023 breach exposing 13.3 million patient records.

State attorneys general in Connecticut, New Jersey, New York, and Michigan settled with Perry Johnson Companies and four related firms over a March 2023 breach. Hackers used stolen employee credentials without multi-factor authentication to access unencrypted files containing names, dates of birth, addresses, Social Security numbers, medical record numbers, insurance details, diagnoses, and clinical results for 13.3 million people, including 4.2 million New York residents. The company learned of the attack only after hackers contacted it on May 2, 2023, demanding payment. Perry Johnson will implement cybersecurity programs, multi-factor authentication, encryption, annual risk assessments, and data disposal rules; it faces $300,000 penalties with up to $9.7 million more if terms are unmet.

Key facts
  • 13.3 million people exposed including 4.2 million New York residents
  • Breach March 2023 using stolen credentials and unencrypted files
  • Data includes names, SSNs, medical records, diagnoses
  • Company discovered breach May 2, 2023 after hackers demanded payment
  • $300,000 penalty plus up to $9.7 million additional
  • Required: MFA, encryption, annual risk assessments
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. May 2, 2023Hackers contact Perry Johnson demanding payment · Malwarebytes Labs
  2. Nov 6, 2026Settlement announced by New York AG and three other states · The Record

What each outlet adds

beyond the shared facts
  • The RecordSettlement with Connecticut, New Jersey, New York, and Michigan
  • DataBreaches.netUp to $10 million total penalties and 4.2 million New York residents affected
  • Malwarebytes LabsDetailed security failures like no MFA and weak passwords
Vendors
Perry Johnson & AssociatesInc.
Victims
13.3 million individualsPerry Johnson & AssociatesPerry Johnson Companies
Organizations
NYS Attorney GeneralNew York Attorney General Letitia James office
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 5d ago The RecordFirst report

    Medical services company settles with 4 states over 2023 hack

    Perry Johnson Companies agreed to pay $300,000 and implement security reforms after a 2023 breach of data for more than 13 million people.

  2. · 5d ago DataBreaches.net

    Perry Johnson companies pay up to $10 million after 2023 breach

    Settlement requires robust security policies and up to $9.7 million more penalties; 13.3 million individuals impacted including 4.2 million in New York.

  3. · 2d ago Malwarebytes Labs

    13.3 million people’s medical data exposed in settlement with companies

    New York AG settles with Perry Johnson & Associates for $300,000 over breach exposing 13.3M medical records, with $9.7M more at risk if terms unmet.