State attorneys general secure up to $10 million and corrective action plan from Perry Johnson companies after 2023 breach
A coalition of four state attorneys general, led by New York's Letitia James, reached a settlement of up to $10 million with Perry Johnson & Associates and related companies following a 2023 data breach. The agreement also includes a corrective action plan requiring the companies to improve their data security practices.
Why this matters: PJ&A is a medical transcription company. That means the data exposed in this breach was not generic account info — it was dictated notes from doctors, patient histories, and clinical details. People never chose to share that information with PJ&A. It passed through as a back-office service they never saw. Ten million dollars spread across a breach affecting millions of patients is not a heavy penalty. The corrective action plan matters more. The real test is whether these companies actually change how they protect data they were trusted with by default.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.