---
title: NY AG and three states settle with Perry Johnson medical transcription firms over a 2023 breach of 13.3 million patients' records | ctxsec
url: https://ctxsec.com/items/ny-ag-perry-johnson-medical-transcription-breach-settlement-nov-6
description: "New York Attorney General Letitia James and the attorneys general of Connecticut, Michigan and New Jersey announced a settlement with Perry Johnson & Associates and related coding/transcription entities over a March 2023 breach that exposed personal and protected health information of about 13.3 million people, including roughly 4.2 million New Yorkers. Investigators say attackers used an employee's credentials with no MFA, harvested passwords and unencrypted PHI for about two months, and that monitoring software logged the activity without alerting security. The companies must implement MFA, encryption, password and asset management, annual HIPAA-aligned risk assessments and PHI retention rules, pay at least $300,000 (New York gets $100,000), and face an additional $9.7 million if they miss the agreement's terms."
status: "official (New York Attorney General press release, Nov 6); Connecticut, Michigan and New Jersey joined"
published: 2026-11-07
---

> New York Attorney General Letitia James and the attorneys general of Connecticut, Michigan and New Jersey announced a settlement with Perry Johnson & Associates and related coding/transcription entities over a March 2023 breach that exposed personal and protected health information of about 13.3 million people, including roughly 4.2 million New Yorkers. Investigators say attackers used an employee's credentials with no MFA, harvested passwords and unencrypted PHI for about two months, and that monitoring software logged the activity without alerting security. The companies must implement MFA, encryption, password and asset management, annual HIPAA-aligned risk assessments and PHI retention rules, pay at least $300,000 (New York gets $100,000), and face an additional $9.7 million if they miss the agreement's terms.

[← Industry News](/industry) · [markdown](/items/ny-ag-perry-johnson-medical-transcription-breach-settlement-nov-6.md)

official (New York Attorney General press release, Nov 6); Connecticut, Michigan and New Jersey joined

2026-11-07

### NY AG and three states settle with Perry Johnson medical transcription firms over a 2023 breach of 13.3 million patients' records

- **Exposed fields (per AG):** names, DOBs, home addresses, SSNs, hospital account numbers, diagnoses, insurance info, and clinical transcription content including meds and lab/diagnostic results.
- **Lesson:** MFA on remote access and alerting on the detections you already collect would have shortened a two-month dwell.

Sources: [NY Attorney General James press release (Nov 6)](https://ag.ny.gov/press-release/2026/attorney-general-james-secures-10-million-and-critical-reforms-companies-failed) · [The Record: medical services company settles with 4 states (Nov 6)](https://therecord.media/medical-services-company-settles-with-4-state-ags)