HackingHealthcareTechnologyHealthcareStolen CredentialsData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedSupply Chain (3P Vendor)PHIHealth (basic)Identity (basic)Government IDMediumContained

NORTHWELL HEALTH, INC.

bd_781a6b647e1d2e28 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 2, 2023

Filed

Nov 3, 2023

To disclose

26 weeks

Affected

867state residents only

Confidence

66%

Full breach record for NORTHWELL HEALTH, INC. →

Perry Johnson & Associates (PJ&A), a medical transcription vendor, reported a data breach affecting Northwell Health, Crouse Health, and CarePoint Health. Unauthorized access occurred March 27–May 2, 2023, via compromised RDS credentials. The actor demanded ransom and exfiltrated PHI and PII. 867 New Hampshire residents were notified on November 3, 2023, with credit monitoring offered. PJ&A engaged forensic investigators and law enforcement.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 36 days

discovery → filing · 26 weeks / 185 days

Mar 27, 2023

Begins

May 2, 2023

Discovered

Nov 3, 2023

Filed

vs. sector median

+14 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed867 affectedView incident

Name: Perry Johnson & Associates
norm: perry johnson associates

Name: NORTHWELL HEALTH, INC.
norm: northwell health
Industry: HealthcarellmTechnologyllm

Discovered: May 2, 2023
Breach occurred: Mar 27, 2023 – May 2, 2023
Undetected for: 36 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 3, 2023
Affected individuals: 867state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: Social Security numberDate of birth
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: valid_credentials

During the incident: Initiated an internal investigation
Engaged a leading forensic cybersecurity firm to assist in its investigation and to confirm the security of its computer systems
Notified law enforcement
Notifying the potentially involved individuals
Offering them complimentary credit monitoring as required by law
Providing them information on how they can protect themselves against fraudulent activity and identity theft
Implemented additional technical restrictions in our systems
Required a password reset for all employees
Deployed an endpoint detection and response system to monitor any unauthorized access of our systems
Changes made: Reviewing its information security policies
Evaluating additional trainings and controls it can implement to reduce the risk of a similar incident occurring in the future
Updating our systems to prevent incidents of this nature from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(185 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/perry-johnson-associates-aka-pja-20231103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 3, 2023
Raw hash: c5007ad07e23bd235b20a491d54ff32435cf861bc00ea55fc2c6e55ad426eee3

Reporting entityPerry Johnson & Associates

Victim entityNORTHWELL HEALTH, INC.

Incidentdiscovered May 2, 2023

Stated responseInitiated an internal investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov