Four state attorneys general announced on 6 November 2026 a settlement with the Perry Johnson companies, the Nevada-based parent of medical transcription, coding and imaging subsidiaries, over a 2023 data breach affecting 13.3 million people. Connecticut, New Jersey, New York and Michigan brought the case.
The Breach
Five companies are covered: Perry Johnson & Associates (PJ&A), Perry Johnson, Inc., PJ&A Coding, PJ&A Radiology, and Medical Transcription and Coding, Inc. The breach began in March 2023 and affected about 4.2 million New Yorkers. The New York AG's investigation found that attackers got in with a PJ&A Coding employee's credentials, and the company did not use multi-factor authentication. Data theft allegedly continued for two months, and the company reportedly learned of it only when the hackers told it.
Settlement Terms
- The company pays $300,000 now.
- If it fails to complete the required cybersecurity reforms, it owes the states another $9.7 million, hence the "up to $10 million" headline.
- New York receives at least $100,000.
- Required controls include MFA, encryption, annual risk assessments and incident-response protocols. Several access-control requirements stay enforceable for seven years.
Takeaways
The case is another example of regulators treating missing MFA on remote access as a baseline failure. Vendors that process protected health information for many providers concentrate risk, and downstream customers should verify the controls of their business associates.