Boston Children’s Health Physicians, a New York pediatric health network, and its IT contractor XTIUM will pay $2.7 million after hackers stole records on about 825,000 New Yorkers in 2024. More than 170,000 of those New Yorkers had Social Security or driver’s license numbers exposed. New York Attorney General Letitia James and Connecticut Attorney General William Tong announced the settlement on October 16.
What the hackers took from the billing files
The breach began in August 2024, when an attacker got into XTIUM, an IT management company that provides network security services. The intruder reached the networks of 18 XTIUM clients. Only the pediatric network, known as BCHP, suffered a data breach, according to the settlement agreement.
The attorney general’s office says about 825,000 New York residents had records taken, and more than 170,000 of those records included Social Security or driver’s license numbers. Another 62,871 Connecticut residents were affected. BCHP also lost more than 4,000 employee records from a separate database, and XTIUM held about 1,000 employee files, including more than 200 New Yorkers.
Anyone whose child was a BCHP patient, who paid a patient’s bill, or who worked for the network could be among those people. BCHP says in the agreement that it notified individuals as required by federal and state law and offered one year of free credit monitoring. A stolen Social Security number is not replaced the way a stolen credit card is, so the exposure can outlast a one-year offer.
Retirement deadlines, in your inbox: Miss an enrollment or claim deadline and the money can be gone. The Retirement Money Brief keeps you ahead of the ones that matter, every weekday.
Get the Retirement Money Brief →
We may earn a commission from links on this page.
XTIUM notified BCHP on September 6, 2024. BCHP detected unauthorized activity on September 10 and had its system restored by September 13. By then the attacker had copied an unencrypted archive of patient billing records, along with employee records.
Patient and guarantor files held names, addresses, dates of birth, Social Security numbers, health insurance information, billing information and treatment information. A guarantor is the person responsible for paying a patient’s bill. Employee files held names, addresses, dates of birth, Social Security numbers and driver’s license numbers.
Where the $2.7 million goes
The money goes to the states, not to patients. Under the assurance of discontinuance, the legal agreement that settles the case, BCHP and XTIUM owe the $2.7 million jointly within 30 days of the agreement taking effect. The attorney general’s signature on it is dated October 16.
James’s office puts New York’s penalty at $2.1 million and Connecticut’s at $540,000. Connecticut’s attorney general joined the case, and the two states divide the payment in amounts they designate.
A larger sum is held in reserve. BCHP alone owes a suspended $1.3 million, which comes due within 60 days if New York finds the network materially breached the agreement within 10 years. The press release lists those contingent amounts as $1,040,000 for New York and $260,000 for Connecticut. If triggered, the agreement totals $4 million in penalties and costs.
What the attorneys general say went wrong
James said BCHP knew its data security features were inadequate but did not fix them. Her office says the network had not put in place common information security policies and procedures, standard security tools or an incident response plan. It also says BCHP did not manage vendor security or run a vendor assessment program, which matters because the breach came in through a vendor. Tong said BCHP had an obligation to safeguard patient records and failed to do so.
Security executives at BCHP knew for at least two years before the breach that an unencrypted archive of more than one million patient billing records sat largely unprotected, the state says. A 2023 information security audit, in which BCHP took part, had already identified several issues.
The state’s findings against XTIUM are different. It says the company did not adopt reasonable safeguards for client network data or employee data, did not enforce common IT standards, and lacked the logging and monitoring needed to catch misuse of a remote support tool account. XTIUM still cannot confirm how the hackers got into its system.
What the settlement now requires
The agreement sets security requirements aimed at the gaps the state describes. The information security program must follow zero trust principles, meaning no user or device is trusted by default, with annual risk assessments and testing. Multifactor authentication is required for consumer personal information and for remote access, and that information must be encrypted.
Networks must be segmented so systems communicate only when business requires it. Centralized logging must keep logs immediately accessible for at least 90 days and stored for at least one year. A data inventory of private information is due within 180 days and must be updated every year.
Oversight runs for years. An independent assessment is due within 180 days and then annually for three years, with reports going to the attorney general’s office within two weeks. BCHP’s chief executive, chief operating officer and chief information security officer must sign compliance certifications under penalty of perjury, first within one year and then annually for five years.
Was a child’s billing record in that archive?
A Social Security number taken from a billing archive does not expire when a one-year monitoring offer does, and more than 170,000 New Yorkers had Social Security or driver’s license numbers in this one. The $2.7 million goes to two states, not to the people whose records were taken.
The settlement leaves the protection question open, and that is the job the Senior Fraud Defense & First-Hour Recovery Kit takes on. It includes the free credit-freeze steps, a first-hour recovery plan and a fraud evidence and report log, laid out in eight parts from the first-hour clock to printables and contacts.
Get the credit-freeze steps and first-hour recovery plan in one kit →
More Financial Reading
- 21 Ways to Stretch a $2,087 Social Security Check
- 15 Places to Find Your Share of the $4.25 Billion States Give Back
- 15 Steps to Stop the Scams That Took $7.7 Billion From Seniors
This article was produced with AI assistance and edited for accuracy against the sources linked above.
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
