NEW York and Connecticut prosecutors have secured a combined 2.7 million dollars from Boston Children’s Health Physicians (BCHP) and its IT provider XTIUM over a 2024 data breach. The settlement follows an investigation that found BCHP failed to enforce basic information security practices and to manage its vendor security programme effectively. The breach allowed access to the networks of BCHP and its subcontractor, resulting in the exposure of hundreds of thousands of records across New York and Connecticut.
In detail, the breach affected approximately 825,000 New York residents and 62,871 Connecticut residents. Hackers stole personal data including Social Security numbers and driver’s licence numbers for more than 170,000 New York residents. The investigation also revealed that BCHP had hosted an unencrypted archive with more than one million patient billing records containing names, addresses, dates of birth, and other sensitive information, which remained largely unprotected prior to the 2024 intrusion. XTIUM was also found to have insufficient safeguards, logging, and monitoring, and could not confirm how the breach occurred.
Under the agreement, BCHP and XTIUM must implement a strengthened information security programme, maintain a data inventory, enforce authentication controls, improve logging and monitoring, and enhance threat response procedures. They will pay a total of 2.1 million dollars to New York, 540,000 to Connecticut, with potential additional penalties of 1.04 million to New York and 260,000 to Connecticut if terms are violated.