Security.nl reported a data breach at PJ&A (United States) on 9 November 2026. It affected 13,300,000 patients.
What we know as of
Status
Reported by Security.nl; not yet confirmed by PJ&A or an authority.
People affected
13,300,000 patients.
When
First reported 9 November 2026.
How
Stolen credentials.
PJ&A’s record
No earlier breach on record under this name.
Not known yet: what data was exposed, when it began and who was behind it. This page is updated as notices and statements come in.
Every fact above has its source below. Journalists: free to quote with credit (“Privacy Unpacked data breach tracker”, with a link to this page and the date); the figures can move. Follow this breach (feed) · Every major breach · Ask us for a figure
People affected
13,300,000patients
Reported
9 November 2026News report
What was exposed
Nobody has said yet what was exposed.
How it happened
How
Stolen password or login In early 2023 attackers were able to log into PJ&A's remote desktop web application, which provided access to internal systems. For this the attackers used the username and password of an employee.sourceOur translation from DutchBegin 2023 wisten aanvallers op de remote desktop webapplicatie van PJ&A in te loggen, waarmee er toegang tot interne systemen werd verkregen. Hiervoor gebruikten de aanvallers de gebruikersnaam en wachtwoord van een medewerker.
News reports are read by an AI model; every fact taken from an article was checked word for word against it, and anything it could not find was dropped. · Corrections and changes
Questions about the PJ&A breach
Was PJ&A hacked?
Security.nl reported a data breach at PJ&A (United States) on 9 November 2026. It affected 13,300,000 patients. How it happened, by the sources: stolen credentials. It has been reported but not confirmed by PJ&A or an authority.
What data was exposed in the PJ&A breach?
The notices and reports so far do not say what was exposed. This page is updated when they do.
How do I know if I was affected?
Organisations normally tell the people whose data was involved, by letter or email, and that notice says what of yours was in it. We cannot look up individual people. If you got a notice, check that it is real, then follow the steps on this page.
Is there a PJ&A data breach settlement?
No settlement open for claims is on record for PJ&A as of 15 November 2026. A settlement usually comes a year or more after a breach, if a court approves one. Every open settlement is listed with its deadline.
Is a letter, email or text about the PJ&A breach real or a scam?
A real notice names the breach, says what data was involved and never asks for a password, a code or a payment. Criminals often send fake notices after a breach is in the news. Do not use links or phone numbers in the message: go to PJ&A’s own site, or check the letter here.
Privacy Unpacked