multi-factor authentication
5 articles with this tag
Perry Johnson & Associates (PJ&A) Medical Data Breach: Four States Settle for Up to $10 Million (13.3 Million People), What Was Exposed and What to Do
On November 6, 2026, the attorneys general of New York, Connecticut, Michigan and New Jersey announced a settlement with medical transcription and coding company Perry Johnson & Associates, Inc. (PJ&A) and four affiliates (together, the Perry Johnson companies). It covers a March 2023 breach that affected about 13.3 million people nationwide. According to the states, the exposed information included names, dates of birth, home addresses, Social Security numbers, hospital account numbers, diagnoses and insurance information, plus clinical details from transcription files such as test results and medication names. The states say hackers used a PJ&A Coding employee's credentials, remote access did not require multi-factor authentication, an affiliate's software recorded the hackers' activity but did not alert security staff, and PJ&A learned of the breach about two months later when the hackers contacted it. The settlement is worth up to $10 million: at least $300,000 in penalties now, and a further $9.7 million owed only if the companies fail to meet the agreement's terms. The companies must keep a security program, use multi-factor authentication and encryption, run annual risk assessments and govern how long health data is kept. This site's take: if you got a notice in 2023, the settlement adds no new step, but because Social Security numbers and diagnoses were involved, keep your credit freeze and keep checking your medical statements.
SonicWall SonicOS SSL-VPN CVE-2026-19868: SAML and its MFA can be bypassed, in CISA KEV (upgrade Gen7 and Gen8)
CVE-2026-19868 is a flaw in the SSL-VPN service of SonicWall SonicOS, the operating system of SonicWall's firewalls. Per SonicWall's advisory SNWLID-2026-0014 of November 6, 2026, on a firewall where SAML is enabled for SSL-VPN logins, a user with valid credentials for an alternate authentication method may bypass the SAML authentication controls, and with them the multi-factor authentication (MFA) that SAML enforces. SonicWall says its security team investigated a report indicating potential exploitation. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on November 6, with a due date of November 20. Affected: Gen7 firewalls on SonicOS 7.3.3-7015 and older, and Gen8 firewalls on 8.2.2-8015 and older. Fixed: 7.3.4-7013 and 8.2.3-8015 or later. There is no workaround. The same advisory covers six other CVEs, including flaws in the management interface and a pre-authentication flaw in SSL-VPN that can stop the service. Our conclusion: if you run a Gen7 or Gen8 SonicWall firewall, upgrade it now whether or not you use SAML, and if you rely on SAML and MFA for VPN logins, check which other accounts can still sign in to SSL-VPN.
When Your Web Hosting Provider Is Breached: What Customers Should Do
A provider-side compromise cannot be blocked by customer settings, so the defense shifts from prevention to limiting how much you can lose. The 10 September investigation results established the part that matters most: unauthorized access to the sales management system occurred between April 2023 and March 2026, the affected hosting accounts rose from 583 to 951, and some initial passwords were not hashed. This site's view: treat everything on shared hosting as readable, push secrets, credentials and backups outside the provider, and change any initial password you are still using today.
What is a one-time password (OTP)? TOTP vs HOTP vs SMS, and its limits
A one-time password (OTP) is a short-lived, single-use code that becomes invalid once used. Types: authenticator-app TOTP (time-based), HOTP (counter-based), and SMS-OTP. It's strong against leaked and reused passwords and is commonly the 'something you have' factor in 2FA. But it has a limit: adversary-in-the-middle (AiTM) phishing can relay an OTP through a fake site and still get in. Strong phishing resistance comes from a domain-bound passkey. OTP is 'much better than nothing, but not the final step.'
What is two-factor authentication (2FA)? vs two-step, and the strength of each method
Two-factor authentication (2FA) strengthens identity checks by adding a different category of proof — 'something you have' or 'something you are' (a code, key, or biometric) — on top of 'something you know' (your password). It is strictly not the same as two-step verification (two checks, not necessarily two categories). Strength depends on the method: SMS/email < authenticator app (TOTP) < passkey/security key (FIDO2). This site's stance: turn on some 2FA everywhere first, then move key accounts to methods you can't hand to a phishing site.