2023 Concentra — 4M patients (PJ&A vendor breach)
Data compromised
Names, dates of birth, addresses, medical record numbers, SSNs, insurance information, clinical data
Technical writeup
Concentra Health Services was affected by a breach at third-party medical transcription vendor Perry Johnson & Associates (PJ&A). Unauthorized access occurred March 27–May 2, 2023; Concentra patient data was accessed April 7 and 19. The PJ&A breach affected over 13.45 million across multiple healthcare organizations. Exposed data included names, DOB, addresses, medical record numbers, SSNs, insurance info, and clinical transcription data.
Root cause
Third-party vendor breach (PJ&A); supply chain