Major Health Network and IT Company Face $2.7M Fine for Devastating Data Breach in NY and CT
A data breach affecting hundreds of thousands of New York and Connecticut residents has resulted in a $2.7 million settlement from Boston Children's Health Physicians and XTIUM. The companies, found to have inadequate security, will also implement stronger data protection measures and provide fraud alert coverage to those impacted. New York Attorney General Letitia James emphasized the critical responsibility of institutions to protect sensitive health data.
A significant data breach impacting hundreds of thousands of residents in New York and Connecticut has led to a $2.7 million settlement from a New York-based pediatric health network and an IT management company. New York Attorney General Letitia James and Connecticut Attorney General William Tong announced the settlement on Friday.
The agreement requires Boston Children's Health Physicians (BCHP), which operates locations in Smithtown and Miller Place, and XTIUM, an IT management company that provided network security services to BCHP, to pay $2.1 million to New York and $540,000 to Connecticut. Beyond the financial penalty, the settlement mandates that both companies strengthen their data security protocols, and BCHP must pay additional sums to the states if it fails to comply with these requirements. Impacted residents will also receive fraud alert coverage as part of the settlement.
The breach, which occurred in August 2024, saw hackers gain unauthorized access to 18 of XTIUM's client networks, including BCHP's. This compromise resulted in the theft of records belonging to approximately 825,000 New York residents and 62,871 Connecticut residents. The stolen information was highly sensitive, including the Social Security and driver's license numbers of more than 170,000 New York residents.
A joint investigation by the offices of Attorneys General James and Tong uncovered several critical security failures. BCHP was found to have failed in adequately addressing deficiencies identified during a 2023 audit. These failures included a lack of common security policies and procedures, the absence of an incident response plan, and the non-utilization of standard security tools. The audit also revealed that BCHP did not have a program to assess its security vendor and had not clearly established the vendor's responsibilities. Furthermore, BCHP data security executives were aware for at least two years prior to the 2024 breach that an archive containing over one million patient billing records was unencrypted and