[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAMQP3I5ekod7o_UinL5DGMXvXwFAd4jsMISBVG4pN4E":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"c593144f-aafe-4822-bcc0-a7189e25fd78","Medical services company settles with 4 states over 2023 hack of sensitive patient records","medical-services-company-settles-with-4-states-over-2023-hack-of-sensitive-patie-acb2cf","The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.","Perry Johnson Companies, a medical services firm, has agreed to pay $300,000 to settle with four state attorneys general following a March 2023 data breach. Hackers gained access using stolen employee credentials due to a lack of multi-factor authentication, exfiltrating sensitive patient health information for two months. The company must also implement significant security reforms or face an additional $9.7 million penalty.","Medical services company Perry Johnson Companies settles for $300K over 2023 patient data hack.","https:\u002F\u002Ftherecord.media\u002Fmedical-services-company-settles-with-4-state-ags","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fhealthcare_data_getty_images_unsplash_600f103bc9.jpg","2026-11-06T19:06:00+00:00","2026-11-06T20:00:03.781213+00:00",8,[17],{"name":18,"type":19},"Perry Johnson Companies","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":41,"vendors":129},[42,71,100],{"slug":43,"name":44,"problem":45,"products":46},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":72,"name":73,"problem":74,"products":75},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":101,"name":102,"problem":103,"products":104},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[],{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":142},"missing-mfa-leads-to-300k-settlement-after-two-month-patient-data-breach","Missing MFA Leads to $300K Settlement After Two-Month Patient Data Breach","Perry Johnson Companies suffered a preventable breach because attackers used stolen employee credentials to access sensitive patient health information — credentials that were not protected by multi-factor authentication (MFA). The absence of MFA meant that once credentials were compromised, attackers had unchallenged access for a full two months before detection, dramatically amplifying the harm. This case illustrates that credential theft is one of the most common attack vectors, and MFA remains one of the most effective and low-cost controls to stop it. The two-month dwell time also reveals a failure in monitoring and anomaly detection, without which breaches go unnoticed until significant damage is done. Regulatory settlements and mandatory remediation requirements serve as a costly reminder that basic security hygiene failures carry serious legal and financial consequences.",[135,136,137,138,139,140,141],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","GDPR Article 32","MITRE ATT&CK T1566: Phishing",{"GDPR Article 32":143,"MITRE ATT&CK T1566: Phishing":144,"NIST SP 800-53 SI-2: Flaw Remediation":145,"CIS Control 6: Access Control Management":146,"CIS Control 17: Incident Response Management":147,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":148,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":149},"Article 32 requires appropriate technical measures to ensure a level of security proportional to the risk of processing sensitive personal data; the absence of MFA on systems holding patient records constitutes a failure to meet this obligation.","Stolen credentials are frequently obtained via phishing; mapping this threat to the MITRE ATT&CK framework would have highlighted credential theft as a top attack vector, prompting both MFA deployment and phishing-resistant authentication controls.","While focused on remediation, SI-2's broader security posture requirements—including monitoring and timely response to security weaknesses—would have prompted faster detection of the ongoing unauthorized access over the two-month dwell period.","CIS Control 6 mandates the use of MFA and least-privilege access; had these requirements been enforced, stolen credentials alone would not have been sufficient for the attackers to gain access.","A two-month undetected breach signals a failure in incident detection and response procedures; a mature IR capability with defined detection thresholds would have identified and contained the intrusion far sooner.","This control requires organizations to identify and address security weaknesses, including authentication gaps; a formal vulnerability management program would have flagged the lack of MFA as a critical risk before attackers exploited it.","This control explicitly requires organizations to implement strong authentication mechanisms, including MFA, which was absent and directly enabled the attackers to access systems using stolen credentials."]