VULNpocalypse
MediumBreach / campaignMonitoring

NY AG says Perry Johnson companies’ breach exposed 13.3M people’s data

New York AG says a 2023 breach at Perry Johnson & Associates exposed 13.3 million people’s data; check medical statements and credit reports.

Published
Exploitation
Yes, according to the New York AG, attackers accessed PJ&A systems in March 2023 using an employee’s credentials

What happened

According to the New York Attorney General, announced on November 6, 2026, a coalition of four state attorneys general (New York, Connecticut, Michigan and New Jersey) reached a settlement with Perry Johnson & Associates, Inc. (PJ&A) and four related companies. The AG says a March 2023 data breach affected 13.3 million individuals, including about 4.2 million New Yorkers. Malwarebytes reported the settlement on November 9, 2026. These are the AG’s findings. The companies’ own account is not included in the sources.

The AG says its investigation found that:

  • Attackers accessed PJ&A’s systems in March 2023 using the credentials of a PJ&A Coding employee, and PJ&A did not require multi-factor authentication for remote access.
  • Over the following months the attackers harvested passwords and accessed unencrypted files containing personal and protected health information.
  • PJI’s software recorded the activity but was not configured to alert security staff, and PJ&A learned of the breach when the attackers contacted it two months later.

Malwarebytes adds that the AG found nearly identical passwords circulated by email, and that the companies learned of the attack on May 2, 2023, when the attackers demanded payment.

The AG lists the exposed records as including names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information from medical transcription files such as test results and medication names. Malwarebytes also lists medical record numbers and dates of treatment.

On the settlement, the AG says the companies will pay at least $300,000 in penalties to the states, of which New York receives $100,000. They would owe a further $9,700,000 if they fail to meet the agreement’s terms. Malwarebytes notes these are payments to the states, not an announced compensation payout to patients.

Malwarebytes reports that earlier coverage put the number of affected patients at about 8.95 million. It also reports that the AG found attackers accessed files in shared network storage that the companies did not review, so the total could be higher. That is Malwarebytes’ account of the AG’s findings. The AG press release itself does not state it.

Am I affected?

The sources do not provide a lookup tool or a list of affected providers, so individual exposure is not confirmed. According to the AG, PJ&A provided coding, billing and recording services to health care organizations across the country. Malwarebytes reports that PJ&A’s clients notified affected individuals between October 31, 2023, and February 8, 2024. The sources do not say how those notices were targeted, so a notice (or the lack of one) is not confirmed to show whether your records were in the stolen files. If you are unsure, ask your healthcare provider or insurer using contact details you already trust.

Malwarebytes notes that a breach does not automatically mean someone has misused your information. The sources do not report misuse of the data, and they do not name any threat actor.

What to do now

  1. Do not trust unexpected messages about the breach. Go to your provider’s or insurer’s official website yourself, or use contact details you already trust, as Malwarebytes and the FTC advise.
  2. Review medical bills and Explanation of Benefits statements. The FTC lists bills or statements for services or prescriptions you did not receive as warning signs of medical identity theft.
  3. Review your credit reports. The FTC points to free reports at AnnualCreditReport.com and says to look for unfamiliar medical debt collection notices.
  4. If you find signs of misuse, follow the recovery plan at IdentityTheft.gov. The FTC also advises requesting copies of your medical records from the providers involved and reporting errors in writing.
  5. For organizations that handle protected health information, the AG lists the settlement’s required controls as a reference point: multi-factor authentication, password management, encryption, annual risk assessments consistent with HIPAA, an incident response protocol, and retention and disposal policies. Malwarebytes adds alerting on suspicious activity, network segmentation and penetration testing.

Sources