A pediatric health network and its technology contractor will pay New York $2.1 million after a 2024 data breach exposed records belonging to about 825,000 state residents, Attorney General Letitia James announced Friday.
The settlement announced by James and Connecticut Attorney General William Tong also requires Boston Children's Health Physicians and its security vendor, XTIUM, to pay Connecticut $540,000 and strengthen their data protections. The two states' penalties total $2.64 million.
Hackers entered XTIUM's systems in August 2024 and gained access to 18 clients' networks, including the pediatric practice, according to the attorneys general. They stole records of about 825,000 New Yorkers and 62,871 Connecticut residents from the practice. The compromised information included Social Security and driver's license numbers for more than 170,000 New Yorkers.
Security gaps identified before the breach
The states' investigation found that the health network knew about multiple security problems but did not adequately address them. A 2023 audit had identified missing policies, standard security tools and an incident-response plan, as well as inadequate oversight of the outside vendor's responsibilities.
Executives also knew for at least two years before the breach that the practice kept an unencrypted archive of more than 1 million patient billing records, investigators said. The archive included names, addresses, birth dates, Social Security numbers and medical and financial information. It remained largely unprotected until it was stolen.
Investigators said XTIUM lacked adequate safeguards and monitoring for its remote-support tool. They could not determine how the hackers entered its system. The investigation also found that personal data for 200 XTIUM employees in New York was at risk.
Settlement requires stronger safeguards
Under the agreement, the companies must maintain a comprehensive security program, inventory and protect private information, use reasonable authentication controls, improve system logging and alerts, and strengthen their response to threats.
Boston Children's Health Physicians would owe an additional $1.04 million to New York and $260,000 to Connecticut if it violates the settlement terms, the attorneys general said. Those conditional amounts are separate from the penalties due under the current agreement.
FingerLakes1.com is the region’s leading all-digital news publication. The company was founded in 1998 and has been keeping residents informed for more than two decades. Have a lead? Send it to news@fingerlakes1.com.
