Attorney General James and Attorney General Tong Secure $2.7 Million from Pediatric Health Network and IT Company for Failing to Protect Customer Data

The New York and Connecticut Attorneys General jointly settled with Boston Children's Health Physicians (BCHP), a New York-based pediatric health network, and XTIUM, an IT management company that provided network security services to BCHP, following a data breach that occurred in August 2024. Hackers accessed XTIUM's infrastructure and, through it, 18 of its clients' networks, including BCHP's. The breach resulted in the theft of records belonging to approximately 825,000 New York residents and 62,871 Connecticut residents, including Social Security numbers and driver's license numbers of over 170,000 New York residents. The investigation found that BCHP failed to implement common information security policies and procedures, failed to utilize standard security tools, and failed to adopt an incident response plan. A 2023 information security audit conducted by BCHP itself identified these deficiencies, but BCHP did not take reasonable steps to remediate them. BCHP data security executives knew for at least two years before the breach that BCHP hosted an unencrypted archive containing more than one million patient billing records, including names, addresses, dates of birth, Social Security numbers, and treatment and billing information. That archive remained largely unprotected until it was stolen in the 2024 breach. The investigation further found that XTIUM failed to adopt reasonable safeguards for both customer network data and the personal data of its own employees, 200 of whom were New York residents. XTIUM failed to enforce common IT system standards and lacked sufficient logging and monitoring to detect misuse of its remote support tool account. Under the settlement, BCHP and XTIUM will pay $2.1 million to New York and $540,000 to Connecticut. BCHP faces an additional contingent penalty of $1,040,000 to New York and $260,000 to Connecticut upon any violation of settlement terms. Both entities must adopt remedial cybersecurity measures including a comprehensive information security program, a data inventory, reasonable authentication procedures, logging and monitoring systems with suspicious-activity alerting, and enhanced threat response procedures.