Medical services company settles with 4 states over 2023 hack of sensitive patient records

Perry Johnson Companies suffered a preventable breach because attackers used stolen employee credentials to access sensitive patient health information — credentials that were not protected by multi-factor authentication (MFA). The absence of MFA meant that once credentials were compromised, attackers had unchallenged access for a full two months before detection, dramatically amplifying the harm. This case illustrates that credential theft is one of the most common attack vectors, and MFA remains one of the most effective and low-cost controls to stop it. The two-month dwell time also reveals a failure in monitoring and anomaly detection, without which breaches go unnoticed until significant damage is done. Regulatory settlements and mandatory remediation requirements serve as a costly reminder that basic security hygiene failures carry serious legal and financial consequences.