F500 Pharma & Biotech · Pharmaceuticals · Private litigation + Data breach
Johnson & Johnson
Headline
The 2023 breach hit Johnson & Johnson's PATIENT ASSISTANCE programme - the mechanism through which people who cannot afford a drug apply for help paying for it.
The 2023 breach hit Johnson & Johnson's PATIENT ASSISTANCE programme - the mechanism through which people who cannot afford a drug apply for help paying for it. That means the exposed population was, by definition, selected for financial vulnerability and for having a specific diagnosis, and the application process itself requires disclosing both. J&J is also a defendant in the national opioid settlements, having agreed to pay up to $5 billion over no more than nine years alongside the $21 billion distributor settlement, with no admission of wrongdoing. Copay assistance is genuinely valuable and people should use it - but it should be understood as a data transaction as well as a financial one.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; the legal tier of its sources has not been assigned yet.
Primary source. www.hipaajournal.com/ibm-johnson-johnson-health-care-systems-breach-lawsuit/ — Verified - primary source confirmed.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected for consumer-facing J&J products.
Data sharing
CONFIRMED BREACH (2023) AT PATIENT ASSISTANCE PROGRAM: Johnson & Johnson Health Care Systems' Janssen CarePath platform (a program helping patients afford J&J medications) was breached via IBM, the business associate managing the platform's application/database — an unauthorized third party accessed the system Aug 2, 2023, exposing an undetermined number of patients' names (HIPAA Journal reported the number affected was unclear), contact information, birthdates, health insurance information, MEDICATIONS, and HEALTH CONDITIONS; affected individuals were not notified until Sept 15, more than a month later. A class action was filed against BOTH IBM and J&J Health Care Systems in New York federal court.
Fees and billing
SEPARATE, UNRELATED REGULATORY DISPUTE (2024-2026): J&J is one of several major manufacturers (with Eli Lilly, Bristol Myers Squibb, Sanofi) suing the federal government (HRSA) over 340B drug-discount program rebate rules — J&J tried shifting two drugs (Xarelto, Stelara) from upfront discounts to a claims-data-validated rebate model, which HRSA warned was unlawful; a federal district court in DC reportedly sided with HRSA in May 2025 (not re-verified in this review; check for appeals). This is a drug-PRICING dispute between manufacturers and hospitals, not a direct consumer-privacy issue, but relevant given how directly it affects what patients ultimately pay.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
| Claim | Kind | Support | Sources |
|---|---|---|---|
| 1. A 2023 breach hit Johnson & Johnson's patient assistance programme. | fact | supported | none recorded |
| 2. The programme is how people who cannot afford a drug apply for help paying for it. | fact | unknown | none recorded |
| 3. The application process requires disclosing financial need and a specific diagnosis. | fact | unknown | none recorded |
| 4. The exposed population was, by definition, selected for financial vulnerability and diagnosis. | characterization | n/a | none recorded |
| 5. J&J is a defendant in the national opioid settlements. | fact | unsupported | none recorded |
| 6. J&J agreed to pay up to $5 billion over no more than nine years. | fact | unsupported | 1 (0 confirmed) |
| 7. This sits alongside the $21 billion distributor settlement. | fact | unsupported | 1 (0 confirmed) |
| 8. J&J's settlement included no admission of wrongdoing. | fact | unsupported | 1 (0 confirmed) |
| 9. Copay assistance is valuable but should be understood as a data transaction as well as a financial one. | characterization | n/a | none recorded |
0 of 9 claims have a confirmed source of their own.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| none | Claim 6 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 7 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
| none | Claim 8 | Unassigned | not found | No quote recorded. Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy jnj.com/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service jnj.com/terms-of-use | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source https://www.hipaajournal.com/ibm-johnson-johnson-health-care-systems-breach-lawsuit/ Verification: Verified - primary source confirmed | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.