Connecticut Attorney General William Tong and New York Attorney General Letitia James secured a $2.7 million settlement with New York-based pediatric health network Boston Children’s Health Physicians (BCHP) and IT management company XTIUM over failures to protect residents’ private information.

In August 2024, a breach at XTIUM allowed hackers to access 18 of its clients’ networks, including BCHP’s. Hackers stole records of approximately 825,000 New Yorkers and 62,871 Connecticut residents, including Social Security numbers and medical information.

The companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut. Tong said: “BCHP collected deeply sensitive information from their pediatric patients and their families. They had an obligation to safeguard those records, and they failed. In coordination with our partners in the New York Office of the Attorney General, we are holding BCHP and their security vendor accountable.”

An investigation by the two attorneys general found that BCHP failed to implement common security policies and tools, despite a 2023 audit that identified such issues. Its data security executives knew for at least two years that BCHP hosted an unencrypted archive of more than one million patient billing records that remained largely unprotected until stolen.

It also found that XTIUM failed to adopt reasonable safeguards for customer network data and employee data, and still cannot confirm how hackers accessed its system.

Both companies must strengthen cybersecurity, including an information security program and threat response. BCHP must pay an additional $260,000 to Connecticut if it violates the settlement.