Four state attorneys general announced a settlement on 6 November 2026 with the Perry Johnson companies over a March 2023 breach that exposed records tied to more than 13.3 million people. The headline figure is up to $10 million. The guaranteed payment is $300,000, about two cents per victim by our calculation from the figures in the New York attorney general’s announcement. The rest of the $10 million is suspended. This settlement pays the states, not the victims. There is no claims process for affected patients.
How much money is actually changing hands?
The companies will pay at least $300,000 in penalties to the states, due within 14 days of the agreement taking effect, according to the New York attorney general’s office. New York will receive at least $100,000 of that sum. Connecticut’s attorney general says his state will receive $66,666 in penalties and costs.
The other $9.7 million becomes due only if the companies violate the agreement or if the New York attorney general finds the companies’ statements about their finances were materially inaccurate. Our calculation puts the gap in plain terms: $300,000 divided by 13.3 million people is about $0.023 per person, roughly two cents. Even the full $10 million would work out to about $0.75 per person. The guaranteed payment is only 3 percent of the headline figure.
About 4.2 million of the affected people lived in New York, roughly 31.6 percent of the total, according to the New York attorney general’s office. Connecticut counted about 107,960 residents, roughly 0.8 percent, according to Connecticut’s attorney general. The four states in the coalition are New York, Connecticut, Michigan and New Jersey.
The $300,000 also looks small next to the same office’s other health data settlements this year. Attorney General James secured $2.7 million from a pediatric health network and IT company in October 2026, $2.3 million and reforms from Labcorp in September 2026, and $18 million from 23andMe in July 2026, according to the New York attorney general’s office. All three sums are larger than $300,000, even though the Perry Johnson breach exposed records tied to more than 13.3 million people.
What happened in the March 2023 breach?
Perry Johnson & Associates was an information technology company that provided coding, billing and recording services to health care organisations across the United States, according to the New York attorney general’s office. Hackers got into its systems in March 2023 using the credentials of an employee at its coding unit. At the time, the company did not require multi-factor authentication for remote access.
Over the next month, the hackers harvested passwords and opened unencrypted files holding personal and protected health information. The company’s own software spotted and recorded the activity, but it was not set up to alert security staff. Perry Johnson only learned about the breach when the hackers contacted the company about two months later.
The exposed records included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical details from medical transcription files such as laboratory and diagnostic test results and medication names, according to the New York attorney general’s office. The settlement covers five companies together: Perry Johnson & Associates, Perry Johnson Inc., its coding and radiology units, and Medical Transcription and Coding Inc.
How long did the breach stay hidden?
The hackers entered in March 2023 and spent the next month moving through the company’s systems, harvesting passwords and opening unencrypted files, according to the New York attorney general’s office. The monitoring software recorded what they did, but nobody on staff saw it, because the alerts were never configured. The failure was not new: in February 2022, a Perry Johnson administrator had asked for the monitoring software to send email alerts, and the request was never carried out, according to the settlement agreement.
Perry Johnson only learned about the breach when the hackers contacted the company about two months later. The settlement was announced on 6 November 2026, roughly three years and eight months after the intrusion. No hacker or group has been named in the attorneys general’s releases, and the releases do not say whether the stolen records were misused for identity theft or fraud in the years since.
Why is the guaranteed payment only $300,000?
The companies say they cannot pay more. The $9.7 million suspension rests on their statements that certain of them are insolvent. The settlement agreement states that four of the five companies, Perry Johnson & Associates, its coding and radiology units, and Medical Transcription and Coding, are insolvent and inactive. The companies neither admit nor deny the attorneys general’s findings.
What do the security reforms actually require?
Any Perry Johnson company that still holds protected health information must run a comprehensive information security program and an incident response plan, according to the New York attorney general’s office. That means multi-factor authentication, password management, encryption and asset management safeguards, annual risk assessments consistent with HIPAA, and written policies on collecting, using, retaining and disposing of personal health information.
Those are the controls missing in March 2023. The breach came through remote access with no multi-factor authentication, the files were unencrypted, and the monitoring software that spotted the intruders never alerted anyone. The settlement now mandates those controls.
The practical reach of the reforms is narrow, because the settlement agreement lists four of the five companies as insolvent and inactive. The program requirements apply to active Perry Johnson entities; inactive ones must return or destroy the information they hold, according to the settlement agreement.
What should you do if your records were in the breach?
Patients who received a breach notice from their care provider were among the more than 13.3 million people affected. The settlement pays the states, not patients, and no payout is coming to you. The useful response is the protections that limit what stolen data can do.
- Freeze your credit at Equifax, Experian and TransUnion to make it harder for anyone to open accounts with your Social Security number.
- Request an IRS Identity Protection PIN so a tax return cannot be filed electronically with your Social Security number alone.
- Read every Explanation of Benefits statement and flag care, prescriptions or tests you never received.
- Ignore emails and ads offering to file a Perry Johnson claim for you, since this settlement announces no claims process.
- Watch for bills or collection notices for medical care you never had, and dispute them in writing.
Frequently asked questions
Will I get money from the Perry Johnson settlement?
No. This is a state-penalty settlement, so the $300,000 goes to the states. No claims process, deadline or compensation for affected individuals was announced. The agreement does not remove any private legal right a person may have.
How do I know if my records were exposed?
No lookup tool was announced. The companies’ clients sent breach notices to affected individuals between 31 October 2023 and 8 February 2024, according to the settlement agreement.
Who was behind the breach?
No hacker or group has been named in the attorneys general’s releases, and the releases do not say whether the stolen records were misused for identity theft or fraud after the breach.
What data was exposed?
Names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, insurance information, and clinical details from medical transcription files such as laboratory and diagnostic test results and medication names, according to the New York attorney general’s office.
When will the $300,000 be paid?
The guaranteed sum is due within 14 days of the agreement taking effect, according to the New York attorney general’s office. New York will receive at least $100,000, and Connecticut will receive $66,666.
What happens if the companies break the deal?
The suspended $9.7 million becomes due immediately if the companies violate the agreement or if the New York attorney general finds the companies’ statements about their finances were materially inaccurate, according to the New York attorney general’s office.
