A 2023 breach affected about 4.2 million New Yorkers, state investigators say. Most of the announced $10 million penalty is suspended under the agreement.

New York and three other states have reached a data-security agreement with the Perry Johnson companies after a breach, known as the Perry Johnson data breach, exposed records associated with more than 13.3 million people nationwide, including about 4.2 million New York residents, according to the state attorney general’s office.

The agreement requires $300,000 in payments to the states and leaves another $9.7 million suspended. That larger amount becomes payable if the companies violate the agreement or if their financial representations prove materially inaccurate. The announcement therefore does not mean the states are receiving $10 million immediately.

Attorney General Letitia James announced the agreement on November 6. The Assurance of Discontinuance, No. 26-039, details the investigation and the companies’ obligations. The respondents neither admit nor deny the attorney general’s findings, and the agreement says it is not an admission of liability.

How investigators say the breach unfolded

The investigation found that attackers entered the PJ&A network in March 2023 using an employee account associated with its coding business. Remote access did not require multifactor authentication, which adds a second check beyond a password.

Over the following month, the attackers explored the network, collected passwords and accessed systems containing patient information, according to the findings. Files included backup databases and shared network files that were not encrypted at the file level.

Monitoring software recorded malicious activity as early as March 29, 2023, the agreement says. Investigators found that it had not been properly configured to alert security staff. The companies learned of the attack on May 2, when the attackers contacted employees and demanded payment to delete files.

The agreement also describes password-management failures. Investigators found that several accounts had been assigned nearly identical passwords, that credentials were circulated together by email and that those passwords had not changed by the time of the breach. Investigators did not determine how the attackers obtained the initial compromised credentials.

What information was affected

According to the agreement, the stolen database files held records associated with more than 13.3 million people. The information included names, dates of birth, addresses, medical record and hospital account numbers, insurance information and Social Security numbers. Some files also contained diagnoses, test results, medication names and other clinical information.

The document says PJ&A began contacting clients about the stolen databases in July 2023. Clients notified affected individuals between October 31, 2023, and February 8, 2024. This week’s development is the enforcement agreement, not the discovery of a new November 2026 breach.

The statewide total does not identify how many affected people live in Utica or the Mohawk Valley. The records reviewed for this report do not establish that a particular local hospital or practice was involved. Residents should not assume that living in New York means their own information was affected.

What the companies must change

The agreement covers Perry Johnson & Associates, Perry Johnson, Inc., and related coding, radiology and medical-transcription businesses. Connecticut, Michigan and New Jersey joined New York in the investigation.

Active businesses covered by the agreement must maintain written information-security programs when they handle personal or protected health information. Those programs include regular risk assessments, testing of safeguards, staff training and oversight of service providers. The requirements also address access controls, multifactor authentication, encryption and incident response.

The document distinguishes active companies from inactive ones. It identifies PJ&A and three related businesses as insolvent and inactive as of the agreement’s effective date. Inactive entities must return or destroy information when they no longer need to retain it for ongoing business or legal reasons. Requirements for active entities apply to covered businesses if they resume activity.

These terms concern how information is handled and protected. They do not erase the records already exposed in the 2023 incident, and they do not establish that every affected person suffered identity theft.

How the payment works

The initial $300,000 payment is due within 14 days of the agreement’s effective date. The suspension of the remaining $9.7 million rests on the companies’ financial representations and compliance with the settlement.

The attorney general’s announcement says New York will receive at least $100,000. The release describes that money as penalties and costs for the state.

The monetary provisions describe penalties and costs paid to the states. They do not announce an application process for individual compensation. Readers should not treat the settlement headline as notice that a payment to patients is available.

Records readers can consult

The full agreement provides the findings, security requirements and payment conditions. This report also draws on the attorney general’s November 6 announcement.

A person checking whether this incident affected them can start with any breach notice already received from a health care provider. The announcement alone cannot establish an individual’s exposure, the details in their record or eligibility for a separate claim.

Featured image: AI-generated conceptual illustration by OpenAI for Mohawk Valley Voice, not actual patient records or evidence.