13.3 Million People's Medical Data Exposed; Companies Pay $300,000
Major Data Breach Exposes Medical Information 🚨
The New York attorney general (AG) has reached a settlement over a significant medical data breach affecting 13.3 million people due to basic security failures. Perry Johnson & Associates (PJ&A) and four related companies have agreed to pay $300,000 and implement extensive security reforms following this breach that exposed personal and medical information.
Key Details:
- Settlement Amount: $300,000
- Potential Penalties: $9.7 million if terms are not met
- Affected Individuals: Over 13.3 million, including approximately 4.2 million New Yorkers
The breach was announced by New York AG Letitia James on November 6, alongside the attorneys general of Connecticut, Michigan, and New Jersey. The investigation revealed a series of failures, including:
- Remote access without multifactor authentication
- Nearly identical passwords circulated via email
- Sensitive files lacking file-level encryption
- Security software that detected malicious activity but failed to alert security staff
The companies only discovered the attack when the attackers contacted them on May 2, 2023, demanding payment. Notifications to affected individuals were also delayed, with PJ&A starting to contact clients in July 2023.
Exposed Information:
The stolen database files contained:
- Names, dates of birth, and home addresses
- Social Security numbers
- Medical record and hospital account numbers
- Insurance information
- Admission diagnoses and treatment dates
- Clinical information from medical transcriptions, including test results and medications
This exposed information could be valuable to criminals, with our research finding stolen identity packages selling for as little as 95 cents on the dark web.
Required Security Changes:
The settlement mandates extensive security changes for the involved companies, including:
- Multifactor authentication for user accounts
- Stronger password management
- Encryption of personal and protected health information
- Monitoring that alerts security personnel to suspicious activity
- Annual risk assessments and penetration testing
- Network segmentation and measures to prevent unauthorized data transfers
- Written incident response procedures and clear rules for retaining sensitive information
For more details, check out the full article: Read full article