PJ&A Data Breach: What Was Exposed and What to Do Now

In short: A March 2023 hack of medical transcription vendor PJ&A exposed health and personal records belonging to more than 13.3 million people in the US, according to a New York Attorney General settlement. The stolen data includes Social Security numbers, diagnoses, insurance details and medication names, but PJ&A is now insolvent, so affected patients should watch for notices from their own healthcare providers rather than from the company itself.

PJ&A, short for Perry Johnson & Associates, is a medical transcription and coding company whose clients included hospitals and clinics around the country. In November 2026, attorneys general in New York, Connecticut, Michigan and New Jersey announced a multistate settlement over a breach that happened three years earlier, in March 2023. Here's what it means if you're one of the millions affected.

How did hackers get into PJ&A's systems?

Hackers logged in remotely using a stolen employee credential for PJ&A's RD Web remote-access application, at a time when the system required no multi-factor authentication, per the New York Attorney General filing. PJ&A's own monitoring software actually logged the intruders' activity starting March 29, 2023, but it wasn't configured to alert security staff. The company only learned of the breach when the attackers contacted it on May 2, 2023, demanding payment to delete the stolen files. A Dutch outlet, Security.NL, describes the intrusion as stemming from "de gestolen inloggegevens van een it-dienstverlener" — the stolen login credentials of an IT service provider.

What personal and health data did PJ&A expose?

The stolen files contained names, dates of birth, home addresses, Social Security numbers, medical record and hospital account numbers, diagnoses, dates of service, insurance information, and clinical details including lab and diagnostic test results and medication names, according to the Connecticut Attorney General's office. Because the data touches both identity and medical history, it's valuable to criminals running health-insurance fraud or tax-refund scams, not just ordinary identity theft.

How many of the 13.3 million affected are near you?

More than 13.3 million people nationwide were affected, including roughly 4.2 million New York residents and about 107,960 Connecticut residents, per the New York settlement document and the Connecticut Attorney General's statement. Investigators also found that files sitting on PJ&A's shared network space were accessed by the attackers but never reviewed afterward to identify every affected individual, meaning the real total could be higher than the confirmed 13.3 million.

Anyone whose healthcare provider used PJ&A for transcription, coding, or radiology services around March 2023 could be on that list, but exactly whose data was taken varies by provider. PJ&A's clients notified their own patients individually between October 31, 2023, and February 8, 2024, according to the same New York filing. Not receiving such a letter doesn't guarantee you were untouched — the unreviewed network files mean some people may never be formally notified at all.

Who was behind it, and is PJ&A still in business?

Beyond the missing multi-factor login step, investigators could not determine how the original employee's credentials were compromised in the first place, the New York Attorney General's filing notes. No hacker group or individual is named in the regulators' documents. PJ&A itself is now reported bankrupt, as Security.NL notes, calling the company "failliet" — which is why patients won't find a notice or FAQ page on PJ&A's own website.

What does the $10 million settlement actually pay for?

The settlement requires PJ&A and related Perry Johnson companies to pay $300,000 within 14 days, with another $9.7 million suspended unless they violate the agreement, totaling up to $10 million, according to the Connecticut Attorney General's announcement. "If the companies fail to meet the terms of the agreement, they will be liable to pay an additional $9,700,000 to the states," the Connecticut office states, adding that Connecticut alone will receive $66,666 of the initial payment. That money goes to the states as penalties and costs, not to individual patients as compensation. Going forward, the companies must adopt multi-factor authentication, encryption, password management, and annual HIPAA-consistent risk assessments.

What should you do if you were notified about this breach?

Follow these steps if you received a notice, or if you believe a healthcare provider used PJ&A around 2023:

1. Check for any notification letter from your healthcare provider (not PJ&A directly) sent between October 2023 and February 2024, and read it carefully for which data categories applied to you.
2. Expect phishing emails, texts, or calls that reference real medical or insurance details to seem convincing; see our guide on phishing scams using your exposed data.
3. Change passwords on any online account tied to the exposed provider, especially if you reused that password elsewhere.
4. If your Social Security number was exposed, follow our steps for what to do if your Social Security number was exposed.
5. Review insurance statements and Explanation of Benefits notices for unfamiliar charges or treatments you didn't receive.
6. Place a fraud alert or credit freeze with the major credit bureaus, since Social Security numbers were among the leaked data.
7. Keep records of any notice you received and any suspicious activity, in case you need them later.
8. For a full walkthrough, see our complete checklist of steps to take after a data breach.

What still isn't known about the PJ&A breach?

Which data fields were exposed for any one person isn't public — that detail exists only in the individual notice letters PJ&A's clients sent between late 2023 and early 2024, so if you kept yours, it is the most precise record you have. The New York Attorney General's filing also leaves open how the employee's credentials were stolen in the first place.