New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a New York-based pediatric health network, and XTIUM, an IT management company that provided network security services to BCHP, for failing to protect the private information of hundreds of thousands of New York and Connecticut residents.  In August 2024, XTIUM suffered a breach that allowed hackers to access 18 of its clients’ networks, including BCHP’s.  Hackers stole the records of approximately 825,000 New York and 62,871 Connecticut residents from BCHP’s network, including the Social Security and driver’s license numbers of over 170,000 New York residents.  As part of a settlement, the companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut and adopt stronger security policies to protect private data.

“Institutions trusted with sensitive private health data have a critical responsibility to protect it from bad actors, said Attorney General James.  “BCHP knew its data security features were inadequate but did not fix them, exposing the information of hundreds of thousands of New Yorkers to hackers.  As a result of our investigation, we are holding BCHP accountable and ensuring they implement new measures to protect New Yorkers’ personal information.”

“BCHP collected deeply sensitive information from their pediatric patients and their families,” said Attorney General Tong.  “They had an obligation to safeguard those records, and they failed.  In coordination with our partners in the Office of the New York Attorney General, we are holding BCHP and their security vendor accountable.”

An investigation by Attorneys General James and Tong found that BCHP put its customers’ personal data at risk by failing to implement common information security policies and procedures.  BCHP failed to reasonably manage its vendor-based security program and adopt standard security protections, which left it vulnerable to hackers.  The investigation discovered that BCHP was aware of many of these failures but did not take reasonable steps to address them.  In 2023, BCHP participated in an information security audit that identified several data security issues.  Those lapses included failing to implement common information security policies and procedures, failing to utilize common standard security tools, and failing to adopt an incident response plan.  BCHP also failed to establish a security vendor assessment program and to clearly establish the vendor’s specific security service responsibilities.  In addition, BCHP data security executives knew for at least two years before the breach that BCHP hosted an unencrypted archive containing more than one million patient billing records including personal, medical, and financial information, such as names, addresses, dates of birth, Social Security numbers, and treatment and other billing information.  This archive remained largely unprotected until it was stolen in the 2024 breach.  The investigation also found that XTIUM failed to adopt reasonable safeguards to protect data of both customer network data and the personal data of XTIUM employees, 200 of which were New Yorkers.  Further, it failed to enforce common standards for its IT system and did not have sufficient logging and monitoring in place to detect misuse of its remote support tool account.  These protections were so deficient that XTIUM is still unable to confirm how hackers accessed its system.  As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.  In addition to financial penalties, the companies must adopt a series of measures to strengthen their cybersecurity practices, including:

• Maintaining a comprehensive information security program designed to protect customers’ private information;
• Developing and maintaining a data inventory of private information and ensuring the information is protected;
• Maintaining reasonable authentication procedures for access to private information;
• Maintaining a logging and monitoring system as well as reasonable policies and procedures to properly configure systems to send alerts of suspicious activity; and
• Enhancing threat response procedures.

This matter was handled for New York by Assistant Attorney General Gena Feist and Deputy Bureau Chief Clark Russell of the Bureau of Internet and Technology, under the supervision of Bureau Chief Kim Berger.  Data Security Analyst Nishaant Goswamy of the Research and Analytics Department also assisted on the matter.  The Bureau of Internet and Technology is a part of the Division for Economic Justice, which is led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Meghan Faux.