In March 2023, hackers used one stolen employee login to get into Perry Johnson & Associates. It's an IT company that handles medical coding, billing, and transcription for hospitals and health systems. Over the following months, the hackers collected more passwords. They walked away with unencrypted files holding some of the most sensitive data there is: names, Social Security numbers, diagnoses, lab results, and medication names. The company didn't find out from its own security tools. It found out two months later, when the hackers contacted them.
In November 2026, four state attorneys general announced a settlement over that breach: New York, Connecticut, Michigan, and New Jersey. The breach affected 13.3 million people nationwide. That includes roughly 4.2 million New Yorkers and about 108,000 people in Connecticut.
What the $10 million settlement actually pays, and to whom
Headlines call this a $10 million settlement. Read closely, and it's smaller than that. The companies pay at least $300,000 in penalties to the four states right now. The other $9.7 million only comes due if the companies break this deal's terms later. Connecticut's own share, for comparison, is $66,666.
There's no claims process here. No payout. No free credit monitoring for the 13.3 million people whose data was taken. The public settlement announcements describe penalties paid to the states, and new security rules the company must follow. They don't describe compensation for affected patients. If you were notified about this breach, there's no form to fill out here.
Why it happened
The attorneys general laid out exactly what went wrong. Perry Johnson didn't require multi-factor authentication for remote access to its systems. That's the second code or app confirmation beyond just a password. It's free on almost every account that offers it. The company also had monitoring software that actually caught the hacker's activity in real time. It just wasn't set up to alert anyone.
As part of the settlement, Perry Johnson must now build a real security program. That means multi-factor authentication, encryption, annual risk assessments, and clear rules for how long patient data gets kept. Connecticut Attorney General William Tong put it plainly:
"Companies have a responsibility to safeguard sensitive information, and we will not hesitate to hold them accountable when they fail to do so."
What to do if you got a notification letter
Medical breaches like this one don't come with a simple fix. You can't change your diagnosis history or lab results the way you'd change a password. But the exposed Social Security numbers and personal details still need the same defense any SSN leak does.
- Freeze your credit. Free at Equifax, Experian, and TransUnion. It's still the strongest block against someone opening new accounts with your SSN.
- Watch for medical bills or insurance claims you don't recognize. A leaked hospital account number can be used for medical identity theft, not just financial fraud.
- Check your insurer's Explanation of Benefits statements. An unfamiliar provider, or a date you weren't treated, is a real warning sign. Don't write it off as a billing error.
- Call your state attorney general's consumer line if you have questions. Connecticut residents can reach theirs at 860-808-5318. Each participating state has its own.
Was your email tied to this breach or any other?
Our free scan shows which known breaches contain your email and whether identity data was exposed alongside it.
Run the Free Breach Scan →