Four state attorneys general have reached a settlement with a health care services company over a March 2023 breach that exposed sensitive patient information for more than 13 million people nationwide. Under the agreement announced by the office of New York Attorney General Letitia James, the firm will pay $300,000 and adopt a set of cybersecurity requirements. Connecticut, New Jersey, New York and Michigan brought the case against the medical transcription, coding and imaging subsidiaries of Nevada-based Perry Johnson Companies.
How the Intrusion Unfolded
According to the attorney general’s investigation, the attacker entered the network using an employee’s credentials. The company did not enforce multi-factor authentication to verify users, which left a single set of stolen credentials as a sufficient route into its systems. Once inside, the intruder harvested passwords and obtained unencrypted files containing protected health information.
The company’s logging software recorded the attacker’s movements, but it was reportedly misconfigured and failed to alert the information security team. The activity continued for roughly two months, and the firm allegedly learned of the breach only after the hackers contacted it directly.
Data Exposed
The stolen records reportedly included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance details and clinical information drawn from medical transcription files. Some files also contained medication names and diagnostic and laboratory test results.
Required Remediation
The settlement obligates the company to build a comprehensive information security program with defined incident response standards. It must deploy multi-factor authentication, encryption and password management systems, conduct yearly risk assessments, and maintain a formal process governing how it collects, uses, retains and disposes of health data. If the company fails to complete these reforms, it faces an additional $9.7 million payment to the four states.
The firm did not respond to a request for comment. The case is a reminder that a single unprotected credential, combined with monitoring that does not generate actionable alerts, can allow an intruder to operate undetected for an extended period against healthcare data.
