Perry Johnson & Associates (PJ&A) data breach

Perry Johnson & Associates (PJ&A) announced a data breach on Nov 28, 2023 affecting about 13.3 million people, exposing names, dates of birth, addresses and Social Security numbers. It happened through a vendor. On November 6, 2026 the attorneys general of New York, Connecticut, Michigan and New Jersey settled with PJ&A and four affiliates for up to $10 million, with at least $300,000 in penalties payable now, $9.7 million more if required security reforms are not met. No individual claims under the state AG settlement; the patients' class action (MDL No. 3096, E.D.N.Y.) is still pending.

What happened

Hackers used a PJ&A Coding employee's credentials in March 2023 to get into the systems of Perry Johnson & Associates, a Nevada-based medical transcription, coding and billing vendor, harvested passwords and accessed unencrypted files for about two months; PJ&A learned of it only when the hackers contacted the company. New York's attorney general warned in November 2023 that nearly nine million patients were affected, including about four million New Yorkers who were patients of Northwell Health and Crouse Health. The final count is 13.3 million people nationwide, with names, dates of birth, addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information and clinical details such as test results and medications exposed. On November 6, 2026, New York, Connecticut, Michigan and New Jersey settled with PJ&A and four affiliates for up to $10 million: at least $300,000 in penalties now and $9.7 million more if the companies fail to meet required security reforms.

What should I do?

1. Review explanation-of-benefits statements and request your medical records to spot treatments or bills you don't recognize, and dispute any you find.
2. Freeze your credit for free at Equifax, Experian and TransUnion so no one can open new accounts in your name.
3. Request an IRS Identity Protection PIN so nobody can file a tax return with your Social Security number.
4. Tell your health insurer about suspected medical identity theft; for Medicare fraud, report it to the HHS Office of Inspector General.

Is there a settlement?

No individual claims under the state AG settlement; the patients' class action (MDL No. 3096, E.D.N.Y.) is still pending.

More data breaches in the United States →

Check the other services you use →