Perry Johnson & Associates

Disclosed Nov 3, 20239,302,588 affectedConfirmed

Medical transcription firm PJ&A breach exposes data of nearly 9 million patients

Medical transcription vendor PJ&A said attackers accessed its systems in spring 2023 (its California notice lists April 7 to April 19, 2023) and took medical transcription files. It reported more than 8.95 million affected patients to HHS, including patients of Northwell Health and Cook County Health.

What is known

People affected	9,302,588 (as reported to HHS)
Disclosed	Nov 3, 2023
Discovered	May 2, 2023
Happened	Apr 7, 2023
Attack	Hacking
Data exposed	NamesDates of birthAddressesSocial Security numbersHealthInsurance
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: Perry Johnson & Associates

Official noticeatg.wa.gov

Washington Attorney General breach notice: Perry Johnson & Associates

Official noticejustice.oregon.gov

Oregon DOJ breach notice: Perry Johnson & Associates

Regulatoroag.ca.gov

California AG data breach notice: Perry Johnson & Associates, Inc. (PJ&A)

Newstechcrunch.com

9 million patients had data stolen after US medical transcription firm hacked

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): Perry Johnson & Associates (Business Associate, NV)

Notices filed

Residents of CANov 3, 2023

California AGCount not stated

Residents of WANov 3, 2023

Washington AG22,088 people

Residents of ORNov 3, 2023

Oregon DOJ3,891,565 people

TotalNov 3, 2023

Research8,950,000 people

TotalNov 3, 2023

HHS archive9,302,588 people

Residents of CAFeb 5, 2024

California AGCount not stated

Residents of CAFeb 8, 2024

California AGCount not stated

History of this record

records_basis2026-09-25

organization to hhsby backfillSource

records2026-09-25

8950000 to 9302588by backfillSource

data_types2026-09-25

[] to ["names","dob","addresses","ssn","health","insurance"]by seedSource

records_basis2026-09-25

empty to organizationby seedSource

records2026-09-25

empty to 8950000by seedSource

summary2026-09-25

empty to Medical transcription vendor PJ&A said attackers accessed its systems in spring 2023 (its California notice lists April 7 to April 19, 2023) and took medical transcription files. It reported more than 8.95 million affected patients to HHS, by seedSource

title2026-09-25

empty to Medical transcription firm PJ&A breach exposes data of nearly 9 million patientsby seedSource

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to hackingby backfillSource

discovered2026-09-25

empty to 2023-05-02by backfillSource

disclosed2026-09-25

2024-02-05 to 2023-11-03by backfillSource

disclosed2026-09-25

2024-02-08 to 2024-02-05by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about Perry Johnson & Associates