Five related medical transcription and coding companies must improve their data security and pay at least $300,000 under a multistate settlement following a breach that affected about 4.2 million New Yorkers.
The agreement could require an additional $9.7 million if the companies fail to meet its terms, Attorney General Letitia James announced. The additional amount is conditional, rather than an immediate $10 million payment.
How hackers reached patient records
The March 2023 breach began when hackers used a coding employee's credentials to enter a remote-access system that lacked multifactor authentication, according to the attorney general's investigation.
Over the following months, the attackers collected additional passwords stored in unencrypted files and used them to reach more systems. Perry Johnson Inc. had software that recorded the activity but had not configured alerts to warn of suspicious behavior, the state said.
The companies learned of the breach when hackers contacted them about two months after the initial intrusion.
About 13.3 million people nationwide were affected. Exposed information included names, birth dates, addresses, Social Security numbers, hospital ac...