New York secures $10 million settlement over medical data breach

The New York attorney general’s office has announced a settlement over a data breach affecting 13.3 million people, following basic security failures at Perry Johnson & Associates (PJ&A) and four related firms. The agreement requires the companies to pay $300,000 in penalties and implement wide-ranging security reforms; a further $9.7 million could become payable if terms are not met.

New York AG Letitia James disclosed the settlement on 6 November 2026, alongside colleagues from Connecticut, Michigan and New Jersey. About 4.2 million of those affected are New York residents.

The investigation describes a cascade of security shortcomings: remote access without multifactor authentication, the circulation of nearly identical passwords by email, and sensitive files left unencrypted at the file level. Security software detected malicious activity but did not alert staff. The breach was only discovered after attackers contacted the companies on 2 May 2023 and demanded payment.

The exposed dataset included names, dates of birth, home addresses, Social Security numbers, medical records and hospital account numbers, insurance details, and clinical information such as test results and treatments. Notifications to clients were slow, with disclosures beginning between October 2023 and February 2024, breaching state requirements for prompt notification.

The settlement mandates extensive security changes, including MFA for all user and administrator accounts, enhanced password management, data encryption, automatic monitoring alerts, annual risk assessments and penetration testing, network segmentation, and written incident response procedures.