What happened
In March 2023, attackers accessed Perry Johnson Companies’ systems using a valid employee username and password. The organization did not enforce multi‑factor authentication, allowing the intruder to move laterally, harvest additional credentials and download unencrypted files containing protected health information for more than 13 million individuals. Security software logged the activity but was mis‑configured and failed to generate alerts, so the breach continued for about two months until the hackers notified the company. State attorneys general in Connecticut, New Jersey, New York and Michigan sued, resulting in a $300 k settlement and a court‑ordered remediation plan that mandates MFA, encryption, password‑management, annual risk assessments and a formal incident‑response framework.
Why it matters for trust and compliance
- The incident demonstrates the critical control objective of enforcing robust authentication and continuous monitoring, a requirement across HIPAA, NIST CSF and ISO 27001 for protecting health data.
- Showcases the need for continuous MFA enforcement evidence for audit readiness.
- Highlights gaps in logging and alerting that must be documented as part of incident‑response controls.
Who is affected
Healthcare providers and medical transcription/coding services handling PHI
Recommended actions
- Implement MFA for all privileged and remote access accounts.
- Configure centralized logging and real‑time alerting for anomalous credential activity.
- Conduct a risk assessment focused on credential‑theft scenarios and update the incident‑response plan.
- Encrypt all stored PHI and enforce strong password‑management policies.