NY and CT get $2.7M settlement from health network BCHP, IT company XTIUM for data breach

A New York-based pediatric health network and an IT management company will pay $2.7 million to New York and Connecticut after a data breach that impacted hundreds of thousands of residents, New York Attorney General Letitia James' office said Friday.

James and Connecticut Attorney General William Tong secured the settlement from Boston Children's Health Physicians, which has locations in Smithtown and Miller Place, and from XTIUM, which provided network security services to BCHP. The companies will pay $2.1 million to New York and $540,000 to Connecticut. Besides the payout, the settlement also requires the companies to strengthen data security and for BCHP to pay additional sums to the states if it does not comply.

Impacted residents will have fraud alert coverage through the settlement, a state spokesperson said.

"Institutions trusted with sensitive private health data have a critical responsibility to protect it from bad actors," James said in a news release. "BCHP knew its data security features were inadequate but did not fix them, exposing the information of hundreds of thousands of New Yorkers to hackers."

In an August 2024 breach, hackers accessed 18 of XTIUM's client networks, including BCHP's, stealing records for around 825,000 New York and 62,871 Connecticut residents, the state said. The stolen information included the Social Security and driver's license numbers of more than 170,000 New York residents.

A joint investigation by James' and Tong's offices found that BCHP failed to adequately address failures discovered during a 2023 audit, such as an absence of common security policies and procedures, the lack of an incident response plan and for not using standard security tools. The audit also found that the company did not have a program to assess its security vendor and did not clearly establish the vendor's responsibilities, according to a news release.

The attorney general's office says BCHP data security executives knew for at least two years before the 2024 breach that an archive with more than one million patient billing records was unencrypted and left the documents "largely unprotected."  

The joint investigation also found that XTIUM did not adopt "reasonable safeguards" to protect the data of both customers and employees, 200 of whom are New York residents. The company lacked "common standards for its IT system" and oversight procedures to detect misuse of its systems, leaving XTIUM still unable to determine the origins of the breach, according to James' office.

By Brianne Ledda

brianne.ledda@newsday.com@brianne_ledda

Brianne Ledda covers personal finance and affordability for Newsday. She previously covered Southold and Greenport for The Suffolk Times and is a graduate of Stony Brook University.