Missing MFA Leads to $300K Settlement After Two-Month Patient Data Breach
Perry Johnson Companies suffered a preventable breach because attackers used stolen employee credentials to access sensitive patient health information — credentials that were not protected by multi-factor authentication (MFA). The absence of MFA meant that once credentials were compromised, attackers had unchallenged access for a full two months before detection, dramatically amplifying the harm. This case illustrates that credential theft is one of the most common attack vectors, and MFA remains one of the most effective and low-cost controls to stop it. The two-month dwell time also reveals a failure in monitoring and anomaly detection, without which breaches go unnoticed until significant damage is done. Regulatory settlements and mandatory remediation requirements serve as a costly reminder that basic security hygiene failures carry serious legal and financial consequences.
Tactical Insight
Immediate actions
- Enforce multi-factor authentication (MFA) on all employee accounts, especially those with access to sensitive patient data.
- Conduct an emergency audit of all active credentials to identify and revoke any that may have been compromised.
Long-term improvements
- Implement a privileged access management (PAM) solution to restrict and monitor access to systems holding protected health information.
- Establish a formal identity and access management (IAM) policy with periodic access reviews to remove stale or unnecessary permissions.
- Adopt a Zero Trust architecture so that no user or device is trusted by default, regardless of network location.
Detection measures
- Deploy a SIEM or user and entity behavior analytics (UEBA) tool to alert on anomalous login patterns such as off-hours access or bulk data exfiltration.
- Set data loss prevention (DLP) policies to detect and block large-scale exfiltration of patient records in real time.