More than 13.3 million people were affected by the March 2023 data breach at medical-transcription vendor Perry Johnson & Associates, which four state attorneys general settled in November 2026 for “up to $10 million.” Only $300,000 is payable, it goes to the states, and patients have no claim to file; the separate class action, MDL No. 3096, is still pending.
What the States Announced
On November 6, 2026, the attorneys general of New York, Connecticut, Michigan and New Jersey announced a settlement with Perry Johnson & Associates, Inc. (PJ&A), Perry Johnson, Inc. (PJI), Perry Johnson & Associates Coding, Inc., Perry Johnson & Associates Radiology, Inc. and Medical Transcription and Coding, Inc. over the 2023 breach of PJ&A's network. Each state signed its own agreement with the companies; New York's is Assurance of Discontinuance No. 26-039, and Connecticut and New Jersey each signed an Assurance of Voluntary Compliance.The press releases from New York, Connecticut and New Jersey describe the deal as "up to $10 million." The agreements themselves show what that number means in practice: the companies owe $300,000 now, and the remaining $9.7 million is suspended. None of it is set aside for the people whose records were taken, and the agreements create no claim process.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
The $10 Million Figure vs. What Is Actually Paid
Under the monetary terms that appear in the New York, Connecticut and New Jersey agreements, the companies agree to $10 million in penalties and costs, split as follows:• $300,000 is due in full within 14 days of the agreement's effective date.
• $9.7 million is suspended. It becomes immediately due only if a state finds that the financial information the companies gave it is not materially accurate, or if the companies (or their successors) violate the agreement.
The agreements say the suspension is based on the companies' representations that they cannot pay the full amount because some of them are insolvent. They state that, as of the effective date, PJ&A, PJ&A Coding, PJ&A Radiology and Medical Transcription and Coding are insolvent and inactive. PJ&A provided its health-information services until approximately August 2024, according to the findings.
The per-state allocations follow the same pattern. New York's agreement allocates $3,333,334 to New York, of which $100,002 is paid and the rest suspended; the New York release rounds this to "at least $100,000." Connecticut's and New Jersey's agreements each allocate $2,222,222, of which $66,666 is paid and $2,155,556 suspended. Michigan is named as a coalition member in all three releases, but none of them states Michigan's share, and no Michigan release or agreement was located for this report.
There Is No Payment to Patients
The money in these agreements is civil penalties and costs paid to the states, not restitution to individuals. The Connecticut and New Jersey agreements leave each attorney general discretion over how the state's share is used, listing options such as consumer-protection enforcement funds, consumer education, local consumer aid or restitution funds, and investigation costs. None of the three agreements reviewed sets up a fund for affected patients, appoints a claims administrator or provides a claim form.A website or message presenting a "Perry Johnson state settlement claim form" does not match any of these agreements. The agreements also state that nothing in them limits any person's private rights under the law, which leaves the separate federal class action unaffected.
What the Attorneys General Found
The findings below are the attorneys general's. The companies neither admitted nor denied them, and each agreement says it is not an admission of liability.According to the findings, attackers gained access in March 2023 by logging in remotely through a web application with the credentials of a PJ&A Coding employee, at a time when PJ&A did not require multi-factor authentication for remote access. Over roughly the next month they harvested passwords, escalated privileges and accessed backup database files and shared network files that were not encrypted at the file level. Monitoring software run by PJI recorded the activity at least as early as March 29, 2023, but it had not been configured to alert security staff, and the agreements say a PJ&A administrator had asked for email alerts to be turned on in February 2022. The companies learned of the attack on May 2, 2023, when the attackers contacted employees and demanded payment.
The findings also describe password practices the states said were inconsistent with the companies' own policies. The account used to get in was one of nine created in May 2022 with nearly identical passwords, which were sent together in a single email and had not been changed in the ten months before the attack.
The stolen database files held records on more than 13.3 million people, including about 4.2 million New York residents, 539,669 New Jersey residents and 107,960 Connecticut residents. The data included names, dates of birth, home addresses, medical record and hospital account numbers, admission diagnoses, dates of service, Social Security numbers, insurance information and clinical details from transcription files such as test results and medication names. PJ&A's hospital and provider clients sent notices to affected individuals between October 31, 2023 and February 8, 2024.
The Security Requirements
The agreements require each Perry Johnson company that is active, or that becomes active again, to run a written information security program. The listed safeguards include multi-factor authentication for all user accounts and remote access, password rules that bar shared or default passwords, encryption of personal and health information, an asset inventory, annual risk assessments consistent with HIPAA, annual penetration testing, network segmentation, data-loss prevention, centralized logging with automated alerts, intrusion detection and endpoint detection tools, and written data retention and disposal policies.An active company must obtain an independent third-party security assessment within 90 days of becoming active and then annually for three years. Inactive companies must return or destroy the personal and health information they hold once they no longer need to keep it. The companies also agree not to place former PJ&A officers, or people who led privacy or security at the time of the breach or in the five years before it, in roles responsible for privacy or security, and to give each state 60 days’ notice before an inactive company resumes business or changes control. The technical safeguard requirements expire seven years after the effective date.
The Class Action Is Separate and Still Pending
Patients' own claims are in In re Perry Johnson & Associates Medical Transcription Data Security Breach Litigation, MDL No. 3096 (No. 1:24-md-03096), before U.S. District Judge Rachel P. Kovner in the Eastern District of New York. The Judicial Panel on Multidistrict Litigation centralized the federal cases there on January 30, 2024. The plaintiffs allege that PJ&A and several hospital clients failed to protect patient data; those claims are unproven, and no defendant has been found liable.A September 3, 2026 report and recommendation by Magistrate Judge Lee G. Dunst states that the defendants' motions to dismiss were still pending. The same filing addresses a proposed $2.5 million class settlement with North Kansas City Hospital and Meritas Health Corporation that covers only their patients. The magistrate judge recommended preliminary approval and recommended deferring notice to class members while further settlements in the MDL are possible; as of that filing, no notice or claim form had gone out. That proposal does not resolve the claims against PJ&A or the other hospitals. More detail on the litigation is on OCA's PJ&A data breach lawsuit page.
Questions
Does the Perry Johnson state settlement pay patients anything?
The agreements signed November 6, 2026 contain no payment to patients, no consumer fund and no claim form. The money is penalties and costs paid to the four states. Any payment to patients would have to come from the separate class action, MDL No. 3096 in the Eastern District of New York, which has not produced a settlement covering Perry Johnson & Associates.
Why is it called a $10 million settlement if only $300,000 is paid?
The agreements set $10 million in penalties and costs but suspend $9.7 million of it. The companies owe $300,000 within 14 days of the effective date. The suspended $9.7 million becomes immediately due only if a state finds the companies' financial representations were not materially accurate or the companies violate the agreement. The suspension rests on the companies' representations that they cannot pay the full amount because several of them are insolvent.
How much does each state receive?
New York's agreement allocates $3,333,334 to New York, of which $100,002 is paid now. Connecticut's and New Jersey's agreements each allocate $2,222,222, of which $66,666 is paid now. Michigan joined the coalition, but its share was not stated in the New York, Connecticut or New Jersey releases or agreements.
Does the state settlement end the PJ&A class action?
The state agreements say nothing in them limits any person's private rights under the law, and the consolidated class action, In re Perry Johnson & Associates Medical Transcription Data Security Breach Litigation, MDL No. 3096, is a separate proceeding. As of a September 3, 2026 court filing, motions to dismiss by PJ&A and the hospital defendants were still pending, and the only proposed class settlement described in that filing covered patients of North Kansas City Hospital and Meritas Health, with notice deferred and no claim process open.
How did the hackers get into PJ&A's systems, according to the attorneys general?
According to the attorneys general's findings, attackers logged in remotely in March 2023 using a PJ&A Coding employee's credentials at a time when PJ&A did not require multi-factor authentication for remote access. Monitoring software recorded the activity at least as early as March 29, 2023 but was not configured to alert security staff, and the companies learned of the attack on May 2, 2023, when the attackers contacted employees. The companies neither admitted nor denied the findings.
Sources
• New York Attorney General — press release, November 6, 2026: NY Attorney General Announcement• New York Attorney General — Assurance of Discontinuance No. 26-039: New York Agreement (PDF)
• Connecticut Attorney General — press release, November 6, 2026: CT Attorney General Announcement
• Connecticut Attorney General — Assurance of Voluntary Compliance: Connecticut Agreement (PDF)
• New Jersey Attorney General — press release, November 6, 2026: NJ Attorney General Announcement
• New Jersey Attorney General — Assurance of Voluntary Compliance: New Jersey Agreement (PDF)
• U.S. District Court, E.D.N.Y. — Report and Recommendation, ECF No. 214, MDL No. 3096 (Sept. 3, 2026), via CourtListener: MDL 3096 Report and Recommendation (PDF)
