Hack Exposes 13 Million Patient Records at Perry Johnson Companies After Credential Theft and Lack of MFA
What Happened – In March 2023, hackers gained access to the systems of Perry Johnson Companies, a Nevada‑based provider of medical transcription, coding and imaging services. The intrusion began with the use of an employee’s valid credentials; the firm had no multi‑factor authentication (MFA) to verify the user. Once inside, the attackers harvested additional passwords and exfiltrated unencrypted files containing protected health information (PHI) for more than 13 million individuals. The company’s security software recorded the malicious activity but was mis‑configured and failed to generate alerts for the security team. The breach continued for roughly two months before the hackers themselves notified the organization. State attorneys general in Connecticut, New Jersey, New York and Michigan sued, resulting in a $300 k settlement and a court‑ordered remediation plan that includes MFA, encryption, password‑management, yearly risk assessments and a formal incident‑response program.
Why It Matters for Trust & Control Assurance – The episode highlights a core access‑control control objective: enforcing strong authentication and continuous monitoring to protect sensitive health data.
Who Is Affected – Healthcare providers, medical transcription and coding firms, imaging services, and any organization handling large volumes of PHI.
Recommended Actions –
- Deploy MFA for all privileged and remote accounts.
- Harden logging and alerting to ensure anomalous credential use is flagged in real time.
- Conduct a comprehensive risk assessment and update incident‑response procedures to include credential‑theft scenarios.
- Encrypt PHI at rest and enforce strict password‑management policies.
Technical Notes –
- Attack vector: Stolen employee credentials (no MFA).
- Data types exposed: Names, DOB, SSNs, home addresses, hospital account numbers, diagnoses, insurance details, medication lists, lab results.
- Detection gap: Security tooling recorded activity but lacked proper configuration to trigger alerts.
Source: The Record