Four US state attorneys general secured $10m on Friday from Perry Johnson & Associates (PJ&A) and four related companies over a March 2023 breach affecting 13.3 million people, with $9.7m suspended.
New Jersey’s Attorney General, Jennifer Davenport, said on Friday that the companies must maintain security and retention policies and pay at least $300,000 in penalties to the coalition.
If they fail to meet the terms, they will be liable for an additional $9.7m to the states.
The other respondents are Perry Johnson, Inc., Perry Johnson & Associates Coding, Perry Johnson & Associates Radiology, and Medical Transcription and Coding. The settlement takes the form of an Assurance of Voluntary Compliance.
The respondents neither admit nor deny the attorney general’s findings, according to paragraph 27 of the New Jersey assurance.
The assurance was entered into under N.J.S.A. 56:8-3 and 56:8-4 and HIPAA.
What the investigation found
The investigation found that hackers accessed PJ&A’s systems in March 2023 using the credentials of a PJ&A Coding employee, when PJ&A did not require multi-factor authentication for remote access.
Over the following months, the states said, hackers harvested passwords and accessed unencrypted files containing personal and protected health information.
PJI’s software identified and recorded the hacker’s activity but was not properly configured to alert security personnel.
The assurance says the activity was detectable from at least 29 March 2023, but the companies did not become aware of the attack until 2 May 2023.
The records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information from medical transcription files, such as laboratory and diagnostic testing results and medication names.
The attorney general found that PJ&A, PJ&A Coding and PJ&A Radiology violated the HIPAA Security Rule. It also found that the respondents’ conduct violated the Data Breach Notification Law, which requires disclosure of a breach without unreasonable delay and no later than 60 days.
The controls the companies must adopt
Any Perry Johnson company that maintains protected health information must keep a comprehensive information security programme and incident response protocol.
It must also put in place multi-factor authentication, password management, encryption and asset management safeguards, run annual HIPAA-consistent risk assessments, and keep policies on the collection, use, retention and disposal of personal health information.
The assurance goes further for each “Active PJ Entity”: its obligations include penetration testing, monitoring and logging, and endpoint detection and response.
Each active entity must also obtain a third-party assessment within 90 days of becoming active.
The breach affected an estimated 539,669 New Jersey residents. New York’s attorney general, Letitia James, said about 4.2 million New Yorkers were affected and that the state will receive at least $100,000.
Connecticut’s attorney general, William Tong, said about 107,960 people in that state were affected and that Connecticut will receive $66,666 in penalties and costs.
Davenport said more than 500,000 New Jerseyans had information exposed “because of the lackluster cybersecurity protocols this software company had in place”.
She added that the settlement “sends a message that any company handling such sensitive data must take seriously its obligation to keep New Jerseyans’ information safe”.
Christopher Peterson, acting director of the Division of Consumer Affairs, said it was “especially unacceptable that a company holding personal and medical records for millions of people didn’t even realize the breach happened for two months”.
James said: “Your health is your business, and companies entrusted with personal health information have a duty to rigorously protect it.”
Tong said companies “have a responsibility to safeguard sensitive information, and we will not hesitate to hold them accountable when they fail to do so”.
The New York office listed earlier data security settlements it has reached. They include $2.7m in October 2026 from a pediatric health network and IT company, $2.3m in September 2026 from Labcorp, and $18m in July 2026 from 23andMe.
PJ&A was an information technology company that provided coding, billing and recording services to health care organisations across the country.