Four-state settlement announced November 6, 2026; New York Assurance of Discontinuance No. 26-039; breach March 2023
13.3 Million Records, $300,000 Due: Four States Settle the Perry Johnson Medical Transcription Breach
The attorneys general of New York, Connecticut, Michigan and New Jersey announced a settlement on November 6 with five Perry Johnson companies over a March 2023 breach of medical transcription files, under a headline of up to $10 million. The signed New York instrument, Assurance of Discontinuance No. 26-039, requires $300,000, payable in full within fourteen days of the effective date; the remaining $9.7 million is suspended and becomes due only if the companies violate the agreement or their statements about their finances prove materially inaccurate, a suspension expressly premised on four of the five companies being insolvent and inactive. The findings describe an ordinary intrusion that ordinary controls would have stopped. Attackers logged in remotely through the RD Web application using a coding employee credential, and no multifactor authentication was required for remote access. Nine accounts created in May 2022 had been assigned nearly identical passwords differing only in the final digit, the credentials were emailed to several managers in one message against the company own password policy, and ten months later they were unchanged. Monitoring software logged the malicious activity by March 29, 2023, but it had never been configured to alert anyone, although an administrator had asked in February 2022 for email alerts to be set up. The companies learned of the breach on May 2, 2023, when the attackers demanded payment. The exfiltrated database files held records associated with more than 13.3 million individuals, about 4.2 million of them in New York, including names, dates of birth, addresses, Social Security numbers, diagnoses, insurance information and clinical details; shared network files the attackers also reached were never reviewed to count anyone further. The HIPAA counts are charged directly, under the Security Rule and the Breach Notification Rule: the entities conducted general assessments but never a HIPAA risk analysis, and they let an affiliate hold technical access to systems containing protected health information without a written agreement requiring it to safeguard that information. There is no patient fund, no claim form and no monitoring benefit in this settlement; the money goes to the states, and the forward-looking security program, multifactor authentication, encryption, password management and annual risk assessments, binds in practice the one respondent still active.
Executives
Read settlement headlines the way this one is built: $10 million is the suspended figure, $300,000 is the cash, and the difference is a statement about the companies ability to pay, not about the size of the failure. The durable executive lesson is in the findings, not the penalty. A vendor held records tied to 13.3 million people with no multifactor authentication on remote access, shared near-identical passwords, and an alerting request that sat undone for a year. Ask whether your own vendor reviews would surface any one of those three facts before a breach did.
CIO / CISO
This settlement is a checklist written by enforcement. Verify four things in your own estate and in every business associate chain: multifactor authentication on every remote access path, a current HIPAA risk analysis that is actually mapped to the Security Rule rather than a general assessment, written safeguard agreements that run all the way down the subcontractor chain, including affiliates with technical access, and monitoring that is tested to alert a named person, not merely configured to log. Note the charging route: state attorneys general enforced the federal HIPAA rules directly here, so a quiet federal docket is not the same as no enforcement risk.
Engineers
Work the three technical failures in order. First, credentials: find any accounts created in batches with patterned passwords, any credentials ever sent by email, and any rotation policy that is set but not enforced, and rotate what you find. Second, detection: send a test event through your monitoring and prove an alert reaches a person, because the gap in this case was not missing logs, it was an alert nobody ever turned on after being asked. Third, exposure: confirm remote access gateways require multifactor authentication and that shared network stores holding protected information are inventoried, since the unreviewed file shares are the part of this breach nobody ever counted.
Everyone (non-IT)
If your records were in this breach, this settlement sends you no money and opens no claim; anyone advertising a Perry Johnson claim service is not describing this agreement. The useful steps are the standing ones for exposed health and identity data: freeze your credit with the three bureaus, consider an IRS Identity Protection PIN, and read explanation of benefits statements for care you never received. Notices in this case were sent by the health care organizations themselves between October 2023 and February 2024, so an old letter from your provider may be the record that you were affected.