Perry Johnson Companies data breach: what was exposed, what to do

In short: A 2023 hack at medical transcription vendor Perry Johnson & Associates (PJ&A) exposed the names, Social Security numbers, dates of birth, home addresses and hospital account numbers of 13.3 million people nationwide, according to New York's attorney general. A four-state settlement announced in 2026 requires PJ&A and its affiliated companies to overhaul their security and pay at least $300,000 now. If your medical provider used PJ&A for transcription, coding or billing, you should freeze your credit and watch for phishing that uses your exposed details.

Perry Johnson Companies — a group of Nevada-based firms including PJ&A, Perry Johnson, Inc., and affiliated coding, radiology and medical transcription businesses — settled with the attorneys general of New York, Connecticut, New Jersey and Michigan in 2026 over a breach that happened three years earlier. The company provided coding, billing and recording services to health care organizations nationwide, including hospitals whose patients never dealt with PJ&A directly.

What data did the Perry Johnson Companies breach expose?

The breach exposed names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical details pulled from medical transcription files such as lab results and medication names, New York's attorney general found. That combination — a Social Security number plus medical history — supports both financial fraud and medical identity theft.

How many people were affected and how do I know if I'm one of them?

13.3 million people nationwide were affected, including about 4.2 million New Yorkers and roughly 107,960 Connecticut residents, per the New York AG's announcement and Connecticut's own release. An earlier 2023 consumer alert from New York's AG put the number at nearly nine million patients at that stage, including patients of Northwell Health and Crouse Health — hospital systems that used PJ&A for transcription. If your hospital or clinic has ever used a transcription, coding or billing vendor, check whether you received a breach notification letter; that's the most reliable way to know you're included.

What should I do right now if I was affected?

1. Treat any text, email or call referencing a hospital visit, insurance claim or medical bill with suspicion — attackers can use your exposed diagnosis and account details to make phishing messages look legitimate. Our guide on how to spot phishing attacks using your exposed data walks through the warning signs.
2. Change passwords on any account tied to the exposed information, especially if you reused a password across your health portal and other sites.
3. Place a free credit freeze with each of the three credit bureaus, as New York's attorney general recommends.
4. Add a fraud alert to your credit file.
5. Request copies of your medical records and check them for errors or unfamiliar treatments.
6. Contest any unrecognized medical billing and tell your insurance company about it.
7. If you discover medical identity theft, file a report with the FTC, online or at 877-438-4338.

For the full set of steps, see our complete data breach checklist alongside the guidance New York's attorney general issued to affected patients.

How did the breach happen?

Hackers broke in using the stolen credentials of a PJ&A Coding employee in March 2023, and the company did not require multi-factor authentication for remote access, the New York AG's investigation found. Over the following months, hackers harvested passwords and accessed unencrypted files containing personal and health information. The company's own monitoring software recorded the suspicious activity but wasn't configured to alert security staff — the company only learned of the intrusion when the hackers contacted them two months later.

What does the settlement actually require?

Perry Johnson Companies will pay at least $300,000 in penalties immediately, with an additional $9.7 million due if they fail to meet the agreement's new security terms, according to New York's attorney general. Those terms include maintaining a comprehensive information security program, enforcing multi-factor authentication, encryption and password management, running annual risk assessments consistent with HIPAA, and setting clear policies for retaining and disposing of patient data, per Connecticut's attorney general. The case was brought jointly by the attorneys general of Connecticut, New Jersey, New York and Michigan, The Record reports, which said the companies did not respond to its request for comment.

What don't we know yet?

No official settlement document or AG statement names who carried out the attack or why, and none of New York's attorney general's releases say exactly how many of the 13.3 million people had their Social Security numbers specifically exposed versus just names and addresses. If you get a notification letter from PJ&A, a hospital or a state attorney general's office, read it closely — it will tell you precisely which of your data elements were involved.