A large-scale data breach in the United States has exposed the personal and medical information of 13.3 million patients. The incident originated from stolen login credentials belonging to an employee at IT service provider PJ&A.
PJ&A supplied billing, medical transcription, and administrative services to healthcare organizations. In this capacity the company stored extensive patient data, including laboratory results, medication records, and treatment plans.
Attackers gained initial access in early 2023 by logging into the remote desktop web application of PJ&A with a valid username and password. The company did not enforce multifactor authentication. Over the following weeks the intruders explored the network and moved laterally to other systems.
They eventually reached servers and files containing personal information and protected health data of 13.3 million patients. These included an unencrypted database backup and additional files. Although a monitoring system detected the activity, it was misconfigured and never forwarded alerts to security personnel. A 2022 request by a system administrator to enable alert forwarding had not been implemented.
The company only learned of the breach two months later when the attackers contacted it and demanded ransom for deletion of the stolen data. Investigations confirmed entry via stolen employee credentials, though the method of credential theft remains unknown. It is unclear whether PJ&A paid any ransom.
Several US states launched investigations and determined that patient data had not been adequately protected. PJ&A, now bankrupt and part of a larger corporate group, reached a settlement requiring the companies to pay $300,000 to the states and implement specified security measures. Failure to do so will trigger an additional penalty of $9.7 million.
