Perry Johnson & Associates (PJ&A), a provider of transcription services to healthcare providers in the United States, has disclosed a data breach impacting 9 million individuals following a cyberattack that occurred in March of 2023. In their data breach notice, PJ&A stated that an unauthorized third-party gained access to the PJ&A network between March 27, 2023, and May 2, 2023, and exfiltrated copies of specific files from their systems. The organization detailed that the files contained personal health information (PHI) belonging to certain individuals and varied per person. Overall, the following information was exposed: name, date of birth, address, medical record number, hospital account number, admission diagnosis, and dates/times of services. For a portion of impacted individuals, Social Security numbers (SSNs), insurance information, and clinical information from medical transition files (such as laboratory and diagnostic testing results, medications, name of treatment facility, and name of healthcare providers) were also exposed. PJ&A confirmed that the data accessed by the threat actor did not contain credit card information, bank account information, usernames, or passwords. There is currently no evidence, according to PJ&A, that the exposed information has been misused “for the purpose of committing fraud or identity theft.” CTIX analysts will continue to monitor activity surrounding PJ&A’s data breach and will provide updates when available.
- Bleeping Computer: Perry Johnson & Associates Article
- Perry Johnson & Associates: Data Breach Notice