Two states fine a children's health group and its IT vendor $2.7M

Two state attorneys general have settled with Boston Children's Health Physicians (BCHP), a New York-based pediatric health network, and XTIUM, the IT company that handled its network security. The deal totals $2.7 million. It follows a hack in August 2024 that exposed records of about 825,000 New Yorkers and 62,871 Connecticut residents.

What happened

Hackers broke into XTIUM and gained access to 18 of its client networks, including BCHP's. The stolen data included Social Security numbers and driver's license numbers of more than 170,000 New York residents. New York Attorney General Letitia James and Connecticut Attorney General William Tong announced the settlement after a joint investigation.

What investigators found

The states said BCHP did not put common security policies in place and did not manage its vendor's security well. They said it was aware of many of these gaps, including problems flagged in a 2023 security audit.

BCHP executives also knew for at least two years before the breach that an unencrypted archive of more than one million patient billing records was largely unprotected. Unencrypted means the files were not scrambled, so anyone who got in could read them.

XTIUM was found to lack reasonable safeguards for its customers' network data and its own employees' personal data. It also lacked enough logging and monitoring to spot misuse of its remote support tool. The investigation also pointed to an inability to identify how the hackers first got in.

What the companies must do

BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut. If BCHP breaks the settlement terms, it owes another $1,040,000 to New York and $260,000 to Connecticut. Both companies must also make changes:

• Adopt a full information security program
• Build a data inventory, a list of what data they hold and where
• Keep reasonable login and identity checks
• Add logging and monitoring with alerts, and improve their response to threats

What it means for you

The case shows that regulators will hold both a business and its outside tech vendor responsible when a breach happens. Hiring an IT company does not hand off the legal risk. The other lesson is about timing. Known weak spots that sit unfixed for years can become the center of an enforcement case.

Business owners can ask their vendors how they protect data, who can reach it, and how quickly they would notice a break-in. Then fix any gap that an audit has already found.