State attorneys general from Connecticut, New Jersey, New York and Michigan announced a settlement with Perry Johnson Companies, a Nevada-based health care services company. The company agreed to pay $300,000 and make changes to its security practices after a March 2023 breach that exposed data of more than 13 million people nationwide, according to the announcement.
The case targeted the company's medical transcription, coding and imaging subsidiaries. If the firm fails to make the required cybersecurity reforms, it must pay the four states an additional $9.7 million, according to a press release from the office of New York Attorney General Letitia James.
James's office said its probe found that hackers broke into Perry Johnson's systems using an employee's credentials. The office said the company did not use multi-factor authentication to verify users.
According to the press release, the hacker collected passwords and obtained unencrypted files containing patients' protected health data. The company's software recorded the intruder's movements but was allegedly poorly configured and did not flag the activity to the information security team. The firm allegedly learned of the breach only when the hackers alerted it, after data theft had continued for two months.
The stolen records allegedly contained names, dates of birth, home addresses, Social Security numbers, hosp