New York Attorney General Letitia James said on 6 November 2026 that she and the attorneys general of Connecticut, Michigan and New Jersey secured up to $10 million from Perry Johnson & Associates (PJ&A) and related Perry Johnson companies over a March 2023 data breach that affected 13.3 million individuals, including about 4.2 million New Yorkers. The companies will pay at least $300,000 in penalties and costs ($100,000 to New York) and will owe a further $9,700,000 if they fail to meet the agreement's terms.

The NY AG's investigation found that hackers got in with the credentials of a PJ&A Coding employee, that PJ&A did not require multi-factor authentication for remote access, that hackers then harvested passwords and accessed unencrypted files over the following months, that PJI's software recorded the activity but was not configured to alert security staff, and that PJ&A learned of the breach only when the hackers contacted it two months later.

The NY AG says the records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information and clinical information such as lab and diagnostic test results and medication names. Required reforms: an information security program and incident response protocol; MFA, password management, encryption and asset management; annual HIPAA-consistent risk assessments; and policies on collection, use, retention and disposal of health data. (source: New York Attorney General)

The Record reports the company did not respond to its request for comment. (source: The Record)