--- title: "Perry Johnson’s US$10m breach settlement: US$300,000 due, about 2 cents a patient" summary: "What the New York Attorney General’s settlement of 6 November requires: why US$9.7m of US$10m is suspended, and the two controls that failed in the 2023 breach of 13.3 million records." url: https://www.thetechbag.com/blog/perry-johnson-settlement-2-cents-a-record format: Note desk: "Data & privacy" region: Global published: 2026-11-07 facts_checked: 2026-11-07 author: TechBag (The TechBag Journal) tags: ["Perry Johnson & Associates","Perry Johnson, Inc.","medical transcription","health data breach","New York Attorney General","Connecticut","Michigan","New Jersey","Assurance of Discontinuance","settlement","suspended penalty","insolvency","HIPAA","business associate","multi-factor authentication","remote access","security monitoring","alerting","DPDP"] cover: https://www.thetechbag.com/blog/covers/perry-johnson-settlement-2-cents-a-record.png --- # Perry Johnson’s US$10m breach settlement: US$300,000 due, about 2 cents a patient *What the New York Attorney General’s settlement of 6 November requires: why US$9.7m of US$10m is suspended, and the two controls that failed in the 2023 breach of 13.3 million records.* Note · Data & privacy · By TechBag · Published 2026-11-07 · Facts checked 2026-11-07 · Canonical: https://www.thetechbag.com/blog/perry-johnson-settlement-2-cents-a-record The Perry Johnson companies, which did medical transcription, coding and billing for health care organisations across the US, will pay US$300,000 under a US$10m settlement over a 2023 breach of records on 13.3 million people, about 4.2 million of them in New York. New York’s Attorney General announced it on 6 November with Connecticut, Michigan and New Jersey. The other US$9.7m is suspended: it falls due only if the companies break the terms or turn out to have misstated their finances.[1][2] **Figure: A US$10m settlement, of which US$300,000 is due: about 2 cents for each person in the files** *Monetary terms of Assurance No. 26-039 between four US state attorneys general and the Perry Johnson companies, signed 6 November 2026* US$10m Penalties and costs in the settlement Assurance, paragraph 61 US$300,000 Due within 14 days of signing Shared by the four states US$9.7m Suspended, owed only on a breach of terms Premised on insolvency 2.3 cents Paid per person in the stolen files TechBag: US$300,000 ÷ 13.3 million Source: New York Attorney General release and Assurance of Discontinuance No. 26-039; per-person figure TechBag arithmetic · as of 7 November 2026 ## Why up to US$10m means US$300,000 The suspension is written into the settlement, an Assurance of Discontinuance. The states agreed to it on the companies’ representations “concerning their inability to pay the amount in its entirety due to certain Respondents’ insolvency”. Four of the five companies, Perry Johnson & Associates (PJ&A), its coding and radiology units and Medical Transcription and Coding, are “insolvent and inactive”; PJ&A stopped serving health care clients around August 2024. The fifth, Perry Johnson, Inc. (PJI), provided their administrative and technical support. The companies neither admit nor deny the findings.[2] TechBag countTechBag count: the money per person US$300,000 across 13.3 million people is about 2.3 US cents each. The full US$10m would be about 75 cents. New York’s share is US$3,333,334, of which US$100,002 is payable now: about 2.4 cents for each of its 4.2 million residents in the files.[2] ## The two controls the regulators named **No second factor on remote access.** In March 2023 attackers logged in remotely through the RD Web application with a PJ&A Coding employee’s credentials; PJ&A “did not require users to provide multi-factor authentication when remotely accessing PJ&A systems”. How the credentials were obtained was never found, but the account was one of nine created in May 2022 with passwords that differed only in the last digit, sent together in one email, and still unchanged ten months later against a 90-day rotation policy.[2] **Monitoring that told no one.** PJI’s monitoring software “identified and recorded the threat actors’ malicious activity at least as early as March 29, 2023”, but was not set to alert security staff. A PJ&A administrator had asked in February 2022 for email alerts to be switched on; “this was not done”. The companies learned of the attack on 2 May 2023, when the attackers contacted employees and demanded payment to delete the files, 34 days after the first recorded activity by our count. The files held names, dates of birth, addresses, Social Security numbers, diagnoses, insurance details and test results; PJ&A’s clients notified patients from 31 October 2023 to 8 February 2024.[2][1] The core controls bind PJI, and any Perry Johnson company that becomes active again, for seven years: multi-factor authentication for every account and for remote access, centralised logging with automated alerts to security staff, encryption of patient data, annual penetration tests, plus an independent assessment within 90 days of becoming active. Inactive companies must return or destroy the data they hold, and none may hire PJ&A’s former officers, or those who ran its security, into a security or privacy role.[2] In India, the Digital Personal Data Protection Act, 2023 sets a penalty of up to ₹250 crore for failing to take reasonable security safeguards; the safeguard and breach-reporting duties of the DPDP Rules, 2025 apply from 13 May 2027.[3][4] Indian firms that transcribe foreign records already sit in such chains, as [Chennai transcribers who heard Australian court audio](https://www.thetechbag.com/blog/australia-court-audio-chennai-subcontractor) did. How we did this Figures as of 7 November 2026, 4pm IST The amounts, the findings and the reforms are from the Assurance of Discontinuance No. 26-039, read in full, and the New York Attorney General’s release. Where they differ, we use the Assurance: New York’s immediate share is US$100,002 there and US$100,000 in the release, and the release’s “two months later” is, on the Assurance’s dates, 34 days from the first recorded activity. Per-person figures divide the amounts by the people counted in the database files; the Assurance notes that other accessed files were never reviewed for more names, so the true count may be higher and the figure per person lower. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [New York Attorney General, Attorney General James Secures Up to $10 Million and Critical Reforms From Companies That Failed to Protect Private Medical Data](https://ag.ny.gov/press-release/2026/attorney-general-james-secures-10-million-and-critical-reforms-companies-failed) — 6 November 2026 2. [New York Attorney General, Assurance of Discontinuance No. 26-039, In the Matter of Perry Johnson & Associates, Inc. et al. (findings; paragraphs 43, 51, 58, 61–62 and 73)](https://ag.ny.gov/sites/default/files/settlements-agreements/perry-johnson-associates-inc-et-al-assurance-of-discontinuance-2026_0.pdf) — 6 November 2026 3. [Digital Personal Data Protection Act, 2023, section 8(5) and the Schedule (penalties)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) — 11 August 2023 4. [MeitY, Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (notified 13 November 2025; substantive duties from 13 May 2027)](https://www.meity.gov.in/data-protection-framework) — 13 November 2025 **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. **Read this next:** [Amadeus breach hit at least ten airlines through one booking system](https://www.thetechbag.com/blog/amadeus-breach-airlines-one-supplier) — Another supplier holding its clients’ records: one booking system exposed records at ten airlines, and their counts cannot be added. Go deeper on TechBag - [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — multi-factor sign-in for every remote login, the first control the regulators named - [SIEM and log management guide](https://www.thetechbag.com/browse/security/siem-log-management) — centralised logs with alerts that reach a person, the second control - [Encryption and rights guide](https://www.thetechbag.com/browse/data-security-privacy/encryption-rights) — file-level encryption, which the stolen files lacked