Johnson and Johnson Health Care Systems, Inc.

Johnson & Johnson Health Care Systems, Inc. (Janssen) experienced unauthorized access to a database supporting the Janssen CarePath patient support platform. The database was managed by third-party provider IBM. The incident involved a technical method allowing unauthorized access, identified on August 2, 2023. Affected data included names and potentially other personal information, though SSNs and financial account numbers were explicitly excluded. IBM and Janssen remediated the vulnerability and augmented security controls. Affected individuals were offered one year of credit monitoring. The notice covers residents of multiple states, including Delaware, New York, and Maryland.