Supply chain ⛓ Supply Chain

Crouse Health in Syracuse Third-Party Breach (November 2023)

📅 2023-11-01 🏢 Perry Johnson & Associates, Inc., (PJ&A)
Primary Source ↗

Incident Details

NY AG Issues Consumer Alert Regarding PJ&A Healthcare Data Breach | TechTarget. New York's Attorney General issued a consumer alert about the recent PJ&A healthcare data breach. New York Attorney General Letitia James issued a consumer alert to warn New Yorkers about the potential impacts of a data breach that occurred at Perry Johnson & Associates (PJ&A), a medical transcription company. As previously reported , PJ&A discovered a data breach in early May that impacted nearly 9 million individuals, making it one of the largest breaches reported to HHS in 2023 so far. Northwell Health, New York’s largest healthcare provider, was one of the organizations impacted by the breach. Crouse Health in Syracuse, New York was also impacted by the breach. In total, 4 million of the 9 million individuals impacted were New Yorkers. Third-party company: Perry Johnson & Associates, Inc., (PJ&A).

Technical Details

Initial Attack Vector
Compromise of third-party service provider / vendor relationship
Vendor / Product
Perry Johnson & Associates, Inc., (PJ&A)
Supply Chain Attack
✅ Confirmed third-party / vendor compromise

Timeline

  1. 2023-11-01 Breach occurred
  2. 2023-11-30 Publicly disclosed