GRC

No MFA, no alerts: Perry Johnson agrees up to $10m state settlement

Four US states settle with Perry Johnson over a 13.3m-record breach caused by missing MFA and silent alerts. What the ICO expects of UK firms.

Scales of justice graphic with the headline No MFA, no alerts, 13.3m records

Four US attorneys general have settled with the Perry Johnson companies over a 2023 breach of 13.3 million health records that began with one employee login and no multi-factor authentication. UK regulators have already fined British firms for these same failings, so it is worth checking now that your own suppliers are not making them.

What happened

On 6 November 2026, New York Attorney General Letitia James announced a settlement with five related businesses: Perry Johnson & Associates (PJ&A), Perry Johnson, Inc. (PJI), and the coding, radiology and transcription subsidiaries. Connecticut, Michigan and New Jersey joined the case. PJ&A provided coding, billing and transcription services to US healthcare providers, so it held patient data on behalf of hospitals and clinics rather than for its own purposes.

The figures are modest compared with the scale of the breach. The four states share a minimum of $300,000 in penalties and costs. A further $9.7 million falls due if the companies breach the settlement’s conditions, which is why the states describe it as worth up to $10 million. According to the New York and Connecticut press releases, the breach affected 13.3 million people, around 4.2 million of them in New York and roughly 108,000 in Connecticut.

The exposed files covered identity data such as names, birth dates, addresses and Social Security numbers, alongside hospital account numbers, diagnoses, insurance details and clinical content including lab results and medication names. The Record said the company had not replied to its request for comment.

The technical picture

The states’ account of the intrusion is short and familiar. In March 2023 an attacker signed in with valid credentials belonging to an employee of the coding subsidiary. Remote access to PJ&A’s systems was not protected by multi-factor authentication, so a stolen password was enough to get in. Over the following months the intruder collected more passwords and opened unencrypted files holding protected health information.

The most damaging detail concerns detection. The investigators found that PJI’s security software did spot and log the attacker’s actions, but it had not been configured to send alerts to the people responsible for responding. Logging alone is not monitoring. PJ&A only found out about the compromise about two months later, when the attackers got in touch with it themselves.

Under the settlement, any Perry Johnson company holding health data must run a documented information security programme with an incident response protocol. It must enforce MFA, password management, encryption and asset management. It must carry out an annual risk assessment aligned with HIPAA, and it must have rules for how health data is collected, kept and destroyed.

Timeline of the Perry Johnson breach from the March 2023 login without MFA to the November 2026 settlement

Why it matters for UK organisations

This is a US case under US law, but UK regulators have already shown how they view the same failings. In March 2025 the ICO fined Advanced Computer Software Group £3.07 million after a 2022 ransomware attack that disrupted NHS 111 and other clinical services. The attackers came in through a customer account that did not have MFA, and the ICO criticised the incomplete MFA coverage across the company’s estate. It was also the first time the ICO had fined a data processor, the same role PJ&A played for its clients. Information Commissioner John Edwards said at the time, as reported by Silicon UK, that “there is no excuse for leaving any part of your system vulnerable”.

The detection failure also has a UK precedent. When the ICO fined Capita £14 million in October 2025, one of its central findings was alert handling. A high-priority alert fired within ten minutes of the initial compromise, yet the affected device was not isolated for 58 hours, against Capita’s own one-hour target, and the regulator linked this partly to an understaffed security operations centre. Infosecurity Magazine reported that the ICO said Capita had not implemented appropriate technical and organisational measures. That phrase comes from the UK GDPR security-of-processing duty in Article 32, which applies to controllers and processors alike.

Put the cases side by side and the expectations are clear. An internet-facing login without MFA, or an alert nobody acts on, is treated as a failure to take appropriate measures, not as bad luck. Processors can no longer assume enforcement will land only on their clients.

Many UK organisations outsource transcription, billing, payroll, HR or analytics to providers that process data in the US. When that provider is breached, the UK controller still has to answer to the ICO for its choice of processor and the assurances it obtained, and to its own customers and patients. Among the lessons the ICO drew from Capita was that organisations should review the agreements and responsibilities between controllers and processors.

Expert view

None of this surprises me, and that is the problem. In my experience, the gap between “we have MFA” and “every remote route requires MFA” is where most of these incidents start. Conditional access policies carry exclusions, legacy VPN profiles survive migrations, and service or contractor accounts get exempted “temporarily”. When we test, these exceptions are usually the first thing we look for.

The monitoring failure is just as common. Plenty of organisations buy tooling that records the right events, then never tune it, route it or staff it. The PJ&A finding matches the pattern in the Capita case almost exactly. The telemetry existed, but no one acted on it in time. A log that nobody reads is evidence for investigators afterwards. It does not protect you while the attack is happening.

For third-party risk teams, the uncomfortable point is that a questionnaire would probably have recorded PJ&A as having security monitoring and an access control policy. Supplier assurance has to test how controls are configured, not just whether they exist.

What to do now

  1. Close every MFA gap on remote access. List every way into your estate from the internet, including VPN, VDI, remote desktop, cloud consoles and supplier portals, and confirm MFA is enforced with no standing exclusions. Cyber Essentials v3.3 already requires MFA for cloud services and expects it on administrative and internet-accessible accounts.
  2. Prove your alerts reach a human. Trigger a test detection for a suspicious remote sign-in, record how long it takes to reach someone with authority to act, and compare that with your stated response target.
  3. Re-assess processors that hold sensitive data. Ask key suppliers, including US-based ones, for evidence of MFA enforcement and alert routing, not just policy documents. Make sure your contracts require prompt breach notification to you.
  4. Encrypt and minimise what is stored. PJ&A’s attacker found unencrypted health files. Check retention schedules and delete data that suppliers no longer need.
  5. Map this to Cyber Essentials. User access control and secure configuration cover the authentication failures. For organisations in scope, Cyber Essentials Plus testing gives independent evidence that the controls actually work.

Bottom line

A single password without MFA and a security tool that recorded the attack but alerted no one exposed 13.3 million patients’ records for two months. The ICO’s fines against Advanced and Capita show UK regulators treat those same gaps as breaches of the UK GDPR security duty, whether you are the controller or the processor. Check your own estate and your suppliers’ before an attacker does.

Sources

Related Posts