Attorneys general in Connecticut, New Jersey, New York and Michigan said on Friday that units of Perry Johnson Companies will pay $300,000 to settle their case. The Record reported that the March 2023 breach exposed data on more than 13 million people. The firm owes $9.7 million more if it skips the required security changes.
New York's attorney general said hackers got in with an employee's login, and the firm required no second check. Her office said the intruder later took passwords and unencrypted files. The firm's software allegedly logged the activity but was set up badly, so no one was alerted. The theft allegedly lasted two months, and the firm allegedly learned of it only from the hackers. The press release lists Social Security numbers, diagnoses, insurance details and lab results among the stolen records.
A second check, such as a phone code, stops a stolen password from working alone. A log only records events; an alert reaches a person who must act. Unencrypted files mean anyone who gets in can read what they open. Buyers can ask vendors to show incident response standards, yearly risk assessments, and rules for keeping and deleting data. Good answers are written down, tested and have a named owner. The settlement's required reforms make a handy checklist.