The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies. If the firm fails to make the required cybersecurity reforms, it will be required to pay the four states an extra $9.7 million, according to a press release from the office of New York Attorney General Letitia James.
James’ office rolled out a probe that found hackers broke into Perry Johnson’s systems by using an employee’s credentials. The company did not use multi-factor authentication to verify users, according to James’s office. In the months following the hack, the bad actor hoovered up passwords and obtained unencrypted files storing patients’ protected health data, the press release said.
