Health Services Firm Pays $300,000 and Must Overhaul Security After Breach Hit 13 Million People

State attorneys general in Connecticut, New Jersey, New York and Michigan announced a settlement with the medical transcription, coding and imaging subsidiaries of Nevada-based Perry Johnson Companies. The company has agreed to pay $300,000 over a March 2023 breach that exposed the data of more than 13 million people. If it fails to make the required security reforms, it must pay a further $9.7 million.

According to the New York Attorney General's investigation, the attackers got in using an employee's credentials, and the company did not use multi-factor authentication. The attacker then allegedly collected passwords and obtained unencrypted files holding patients' protected health data. The company's software reportedly recorded the intruder's movements, but it was allegedly poorly configured and did not alert the security team. The theft allegedly continued for two months, and the firm reportedly learned of it only when the hackers told it. The stolen records allegedly included names, dates of birth, addresses, Social Security numbers, diagnoses, insurance details and lab results.

Under the settlement, the company must build a comprehensive information security program and incident response standards. It must also introduce multi-factor authentication, encryption and password management, run yearly risk assessments, and manage how it collects, uses, keeps and disposes of health data. The firm did not respond to a request for comment.