Perry Johnson Companies Settle for $10 Million Over Major Data Breach

• •Perry Johnson & Associates exposed data of over 13.3 million individuals due to inadequate security.
• •The breach was facilitated by the use of an employee's credentials without multi-factor authentication.
• •The settlement mandates significant security reforms and imposes penalties totaling $10 million.

A coalition of state attorneys general has secured a $10 million settlement from Perry Johnson & Associates, Inc. and its subsidiaries following a March 2023 data breach that exposed the personal information of over 13.3 million individuals, including approximately 4.2 million New Yorkers. The breach occurred when hackers accessed the company's systems using the credentials of an employee, exploiting the lack of multi-factor authentication. The compromised data included sensitive information such as names, Social Security numbers, and medical records. As part of the settlement, the companies are required to implement robust security measures and will pay at least $300,000 in penalties, with the potential for an additional $9.7 million if they fail to comply. The breach was discovered two months later when the hackers contacted the company, highlighting significant lapses in their security protocols.