NJ Attorney General Secures Up to $10 Million and New Security Rules from Perry Johnson Companies
New Jersey Attorney General Jennifer Davenport, together with attorneys general from Connecticut, Michigan and New York, announced a settlement on November 6, 2026 that could total $10 million. The agreement targets five Perry Johnson companies after a March 2023 cyberattack that compromised the private medical information of 13.3 million people nationwide, including almost 540,000 New Jersey residents.
The companies—Perry Johnson & Associates, Inc.; Perry Johnson, Inc.; Perry Johnson & Associates Coding, Inc.; Perry Johnson & Associates Radiology, Inc.; and Medical Transcription and Coding, Inc.—provided coding, billing and recording services to health‑care providers. Hackers used the credentials of a coding employee to enter the network, and because the firm did not require multi‑factor authentication for remote access, the intruders remained undetected for months.
How the Breach Unfolded
Investigators found that the attackers harvested passwords and accessed unencrypted files containing protected health information. Although the company’s software logged the activity, it was not configured to alert security staff. The breach was only discovered when the hackers contacted the firm two months later.
Source: New Jersey Attorney General
Financial Penalties and New Requirements
Under the Assurance of Voluntary Compliance agreement, the companies must pay at least $300,000 in penalties now and could owe an additional $9.7 million if they fail to meet the settlement terms. Required reforms include implementing multi‑factor authentication, establishing robust password and asset‑management controls, conducting annual risk assessments that meet federal privacy standards, and maintaining clear policies for storing and deleting sensitive records.
What This Means for Affected Individuals
Anyone whose data was exposed should monitor bank accounts, health‑insurance claims and credit reports for unauthorized activity. Free credit reports are available annually, and any suspicious medical charges should be reported to insurers promptly. The settlement does not provide direct compensation to victims, but the mandated security upgrades aim to prevent future exposure of personal health information.
When Consulting an Attorney May Help
If you notice signs of identity theft, fraudulent medical billing, or other misuse of your health data, a lawyer can advise you on your rights under state and federal consumer‑protection laws and help you pursue any available remedies.
What this means: our conclusions
- Good newsHigher Security Standards for Health Vendors
The settlement forces third‑party health‑tech firms to adopt stronger safeguards, which should reduce future breaches.
- RiskIncreased Risk of Identity Theft for Victims
Exposure of Social Security numbers and medical diagnoses leaves millions vulnerable to fraud.
- What to watchState Monitoring of Compliance
Attorneys general will oversee the companies’ security upgrades and may enforce the $9.7 million penalty if rules are broken.
- What to doReview Your Credit and Health Statements
Affected individuals should regularly check credit reports and Explanation of Benefits for unfamiliar activity.
- ContextPotential Ripple Effect Across the Industry
Other health‑tech providers may preemptively improve security to avoid similar actions from state regulators.
| Item | Details |
|---|---|
| Immediate Penalty | $300,000 paid to the multi‑state coalition |
| Conditional Penalty | Up to $9.7 million if compliance terms are violated |
| Security Requirements | Multi‑factor authentication, annual risk assessments, data‑retention policies |
| Affected Population | 13.3 million nationwide; ~540,000 in New Jersey |
Source: New Jersey Attorney General
- Office of The Attorney General nj.gov
- Division of Consumer Affairs nj.gov
- Assurance of Voluntary Compliance njoag.gov
- New Jersey Office of Attorney General njoag.gov
This article is general information based on New Jersey Attorney General and court or agency records available at publication time. It is not legal advice; laws and deadlines differ by state and by case. Published November 6, 2026.
Source: New Jersey Attorney General
New Jersey and FTC Sue Dollar General Over Alleged Register Price Overcharges
New Jersey, the FTC, and 19 other states have filed a lawsuit accusing Dollar General of routinely overcharging shoppers at the register for basic household goods.
Find a lawyer in New Jersey
Reading about the law is one thing, applying it to your own case is another. Browse verified attorneys in New Jersey by practice area.