A pediatric practice and its security vendor together owe $2.64M across two states, closing out claims tied to a 2024 breach that took records of roughly 825,000 New Yorkers and 62,871 Connecticut residents.
Boston Children’s Health Physicians pays New York $2.1M and Connecticut $540,000, under an agreement New York attorney general Letitia James announced Friday with her Connecticut counterpart William Tong, plus $1.3M in penalties if the practice violates the terms.
Hackers got into XTIUM’s environment in August 2024 and from there reached the networks of 18 clients, the attorneys general said, with Social Security and driver’s license numbers belonging to over 170,000 New Yorkers among what was exposed.
The investigation’s findings matter more than the money: multiple security problems were known to the health network and left unaddressed, with missing policies, absent standard tools, no incident-response plan and weak oversight of the outside vendor all having surfaced in a 2023 audit.
Separately, for two years or longer before the breach, executives understood that an archive holding above one million patient billing records had no encryption, and that addresses, names, birth dates, Social Security numbers and medical and financial detail were in it until someone stole it.
XTIUM came up short on safeguards and on monitoring for its remote-support tool, investigators said, and how the intruders got in could not be determined, while personal data on 200 of the vendor’s New York employees was also put at risk.
Both companies must now run a comprehensive security program, catalogue and safeguard private information, apply reasonable authentication, bolster logging, and sharpen threat response.
Handing infrastructure to a managed security vendor is not the same as overseeing it: audit findings need owners and deadlines, legacy archives need encryption or deletion, and remote-access tools deserve the same monitoring as the clinical network.
