Perry Johnson Data Breach Settlement: Up to $10M [2026] - shattered.io

The settlement resolves a joint investigation into a March 2023 breach that exposed medical transcription files containing sensitive personal information. Five Perry Johnson companies are bound by the agreement, which includes a conditional maximum payment of $10 million, with a guaranteed minimum of $300,000.

State-by-State Impact

New York residents represented the largest share of affected individuals, accounting for approximately one-third of the total. New Jersey reported 539,669 affected residents, while Connecticut documented 107,960. Michigan joined the coalition but did not publish a specific state count in the reviewed materials.

The nationwide figure of more than 13.3 million individuals comes from the attorneys general' statements. Some sources report lower numbers, which officials attribute to different counting methods and filing dates.

Exposed Information

The compromised records contained names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses, and insurance information. They also included clinical details from medical transcription files such as laboratory results and medication names.

This combination of identity and health data creates significant risks, including both financial fraud and medical identity theft. Unlike a stolen password, a Social Security number remains with a person for life, and when paired with health information, it enables comprehensive identity theft that extends beyond financial harm.

Settlement Terms

The agreement includes a $300,000 base payment plus an additional $9.7 million that becomes payable only if the companies fail to meet the agreement's requirements. This structure effectively creates a suspended penalty that incentivizes compliance.

Beyond financial penalties, the settlement requires the Perry Johnson companies to implement comprehensive security reforms including multifactor authentication, encryption, password management, and annual risk assessments. The companies must also establish a formal information-security program with defined incident-response standards.

Future Implications

The settlement sends a clear message to healthcare vendors and their clients about shared responsibility for data protection. When corporate entities share systems and data, regulators can bind the entire organization to unified security obligations, regardless of separate legal structures.

Affected individuals should monitor their financial accounts and consider credit monitoring services. The attorneys general' offices will oversee the companies' compliance with the security requirements, with the potential for additional penalties if the reforms are not properly implemented.