Attorney General Tong Secures Up to $10 Million and Critical Reforms from Companies That Failed to Protect Private Medical Data

Press Releases

11/06/2026

Attorney General Tong Secures Up to $10 Million and Critical Reforms from Companies That Failed to Protect Private Medical Data

Data Breach Exposed Personal Information of Over 13.3 Million People Nationwide, Including Approximately 108,000 in Connecticut

(Hartford, CT) -- Attorney General William Tong today joined the attorneys general of Michigan and New Jersey announcing a $10 million settlement with Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc., and Medical Transcription and Coding, Inc. (together, the Perry Johnson companies) following a March 2023 data breach that impacted 13.3 million individuals, including approximately 107,960 in Connecticut. PJ&A was an information technology company that provided services such as coding, billing, and recording to health care organizations across the country, including in Connecticut.

As a result of the coalition's investigation, the companies will be required to maintain robust security and retention policies and practices and will pay at least $300,000 in penalties to the coalition. If the companies fail to meet the terms of the agreement, they will be liable to pay an additional $9,700,000 to the states. Connecticut will receive $66,666 in penalties and costs.

"As a result of Perry Johnson companies' inadequate security measures, hackers were able to get their hands on protected health information for millions of Americans. This settlement includes strong new protections to ensure personal information is secure going forward. Companies have a responsibility to safeguard sensitive information, and we will not hesitate to hold them accountable when they fail to do so," said Attorney General Tong.

The OAG investigation found that in March 2023, hackers accessed PJ&A's systems using the credentials of a PJ&A Coding employee. At the time, PJ&A did not require users to use multi-factor authentication when remotely accessing the company's systems. Over the following months, hackers harvested passwords and accessed unencrypted files that contained personal and protected health information. The investigation revealed that although PJI's software identified and recorded the hacker's activity, it was not properly configured to provide alerts to security personnel. PJ&A only became aware of the breach when hackers contacted them two months later.

The leaked files contained records associated with more than 13.3 million people. The records included personal and private information such as names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical information from medical transcription files, such as laboratory and diagnostic testing results and medication names.

As a result of Attorney General Tong and the coalition's investigation, any Perry Johnson company that maintains protected health information must implement robust data handling and security policies to better protect consumers, including:

• Maintaining a comprehensive information security program and incident response protocol;
• Enacting standard multi-factor identification, password management, encryption, and asset management safeguards and policies;
• Implementing annual risk assessment programs consistent with HIPAA; and
• Maintaining policies and procedures governing the collection, use, retention, and disposal of personal health information.

Deputy Associate Attorney General Michele Lucan, Chief of the Privacy and Data Security Section assisted the Attorney General in this matter.

###

Media Contact:

Elizabeth Benton
[email protected]

Consumer Inquiries:

860-808-5318
[email protected]

• Twitter
• Facebook
• Email
• Print