PJ&A

Data Breach Exposes 13.3 Million US Patients After Stolen Credentials Used at Healthcare IT Provider PJ&A

A major data breach in the United States exposed the personal and medical information of 13.3 million patients due to stolen login credentials at IT service provider PJ&A. The company provided billing, medical transcription, and administrative services to healthcare organizations and held extensive patient records including test results, medication data, and treatment plans. Attackers accessed the remote desktop web application using a single employee's username and password because multifactor authentication was not required. They performed lateral movement across the network and reached unencrypted database backups and files containing protected health information. A monitoring system detected the intrusion quickly but was misconfigured and failed to send alerts to security staff despite an earlier unfulfilled request to enable notifications. The breach was only discovered two months later when the attackers contacted the company with a ransom demand. PJ&A, now bankrupt, reached a settlement requiring payment of $300,000 to multiple US states along with security improvements or an additional $9.7 million penalty.