Pediatric health network and IT vendor settle with Connecticut and New York over 2024 data breach
Boston Children's Health Physicians and XTIUM will pay $540,000 to Connecticut and a $2.1 million penalty to New York after hackers stole records of 62,871 Connecticut residents and about 825,000 New Yorkers, the states' attorneys general said.
A New York-based pediatric health network and the IT company that handled its network security will pay $540,000 to Connecticut and a $2.1 million penalty to New York over a 2024 data breach that exposed the records of 62,871 Connecticut residents and about 825,000 New Yorkers, the two states' attorneys general said Friday.
Connecticut Attorney General William Tong and New York Attorney General Letitia James said the settlement with Boston Children's Health Physicians, known as BCHP, and XTIUM also requires the companies to adopt stronger data security policies. The attorneys general described the total as $2.7 million.
According to the attorneys general, XTIUM was breached in August 2024, giving hackers access to the networks of 18 of its clients, including BCHP. The records stolen from BCHP's network included Social Security numbers and medical information, the offices said.
The investigation found that BCHP failed to adopt common security policies and tools, had no incident response plan and did not properly manage its security vendor, the attorneys general said. A 2023 security audit had identified several of those problems, according to the offices, and BCHP data security executives knew for at least two years before the breach that the network hosted an unencrypted archive of more than one million patient billing records, including names, addresses, dates of birth, Social Security numbers and treatment information. That archive remained largely unprotected until it was stolen, they said.
XTIUM failed to adopt reasonable safeguards for its customers' network data and for the personal data of its own employees, including 16 from Connecticut and 200 from New York, the investigation found. The attorneys general said the company lacked enough logging and monitoring to detect misuse of its remote support tool account and still cannot confirm how hackers got into its system.
Under the settlement, BCHP would owe an additional $260,000 to Connecticut and $1.04 million to New York if it violates the terms. The companies must also maintain a comprehensive information security program, keep an inventory of private data, use reasonable authentication procedures, run logging and monitoring systems that flag suspicious activity, and strengthen their threat response procedures.
This brief was drafted by AI from a public agency or political press release and published by The New England Signal. Why we use AI for stories like this one.