Boston Children's Health Physicians (BCHP) and its IT vendor XTIUM have been ordered to pay over $2.6 million in penalties following a data breach that exposed the personal information of approximately 887,000 people across New York and Connecticut.
According to New York Attorney General Letitia James and Connecticut Attorney General William Tong, the August 2024 breach of XTIUM's systems compromised patient records from 18 of the company's client networks, including BCHP. The breach exposed records of approximately 825,000 New York residents and 62,871 Connecticut residents, including the Social Security and driver's license numbers of more than 170,000 New Yorkers.
Investigators determined that BCHP had known for at least two years before the breach that an unencrypted archive containing more than one million patient billing records lacked adequate protection. A 2023 security audit had previously flagged multiple data security deficiencies at the organization.
The investigation also revealed that XTIUM lacked adequate logging and monitoring of its remote support tool accounts and was unable to confirm how hackers gained access to the systems.
Settlement Terms
Under the settlement, XTIUM will pay $2.1 million to New York and $540,000 to Connecticut. BCHP faces an additional $1.04 million penalty to New York and $260,000 to Connecticut if it violates the settlement terms.
Both organizations must implement a comprehensive information security program that includes maintaining an inventory of private data, strengthening authentication protocols, establishing logging systems with alerts for suspicious activity, and improving threat response procedures.
BCHP had previously agreed to a $5.15 million class action settlement related to a separate 2024 cyberattack at its IT services provider.
