DisclosureLens
HackingHealthcareHealthcareCustomer Data InvolvedData ExfiltratedBusiness Associate (HIPAA)PIIPHIIdentity (basic)Government IDCriticalContained

Perry Johnson & Associates

bd_37c0bc2703c85d05 · schema v1 · pii pii-v1

Severity

Critical

Discovered

May 2, 2023

Filed

Feb 8, 2024

To disclose

40 weeks

Affected · nationwide

13,300,75042,220 in this filing

Linked

9 filings

Confidence

50%
Full breach record for Perry Johnson & Associates →

Perry Johnson & Associates, Inc. (PJ&A), a medical transcription services company, reported a data breach impacting 42,220 Maine residents. An unauthorized party gained access to its systems between March 27, 2023, and May 2, 2023. The breach was discovered on May 2, 2023, with the involvement of Protected Health Information (PHI) confirmed on May 22, 2023. The compromised data includes names and Social Security Numbers. The company provided notice to affected individuals and offered at least 12 months of identity theft protection services.

Maine clockDiscovered May 2, 2023 → Filed with AG Feb 8, 2024282d ✗ ME AG >90d40 weeks discovery → filing
⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 36 days
discovery → filing · 40 weeks / 282 days

Mar 27, 2023

Begins

May 2, 2023

Discovered

Feb 8, 2024

Filed

vs. sector median

+28 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Show 4 more filings ↓up to 97d gap

Filing propagation · 9 filings · 8 states

View merged incident ↗
California State AGNov 3 · first
Massachusetts State AGNov 3 · first
HHS OCRNov 3 · first
Montana State AGNov 3 · first
Oregon State AGNov 3 · first
South Carolina State AG+3d
New Hampshire State AG+97d
Maine State AG+97d · this page
Massachusetts State AG+98d

Pattern: first filing Nov 3 (CA), last Feb 9 (MA) — a 98-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.