Press Releases
10/16/2026
Attorney General Tong and Attorney General James Secure Settlement with Pediatric Health Network and IT Company for Failing to Protect Customer Data
Boston Children’s Health Physicians and XTIUM Failed to Protect Personal Information for 62,871 Connecticut Residents and Approximately 825,000 New Yorkers
(Hartford, CT) – Connecticut Attorney General William Tong and New York Attorney General Letitia James today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a New York-based pediatric health network, and XTIUM, an IT management company that provided network security services to BCHP, for failing to protect the private information of hundreds of thousands of Connecticut and New York residents. In August 2024, XTIUM suffered a breach that allowed hackers to access 18 of its clients’ networks, including BCHP’s. Hackers stole the records of approximately 825,000 New Yorkers and 62,871 Connecticut residents from BCHP’s network, including Social Security numbers and medical information. As part of a settlement, the companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut and adopt stronger security policies to protect private data.“BCHP collected deeply sensitive information from their pediatric patients and their families. They had an obligation to safeguard those records, and they failed. In coordination with our partners in the New York Office of the Attorney General, we are holding BCHP and their security vendor accountable,” said Attorney General Tong.
“Institutions trusted with sensitive private health data have a critical responsibility to protect it from bad actors,” said Attorney General James. “BCHP knew its data security features were inadequate but did nothing to fix them, exposing the information of hundreds of thousands of New Yorkers to hackers. As a result of our investigation, we are holding BCHP accountable and ensuring they implement new measures to protect New Yorkers’ personal information.”
An investigation by Attorneys General Tong and James found that BCHP put its customers’ personal data at risk by failing to implement common information security policies and procedures. BCHP failed to reasonably manage its vendor-based security program and adopt standard security protections, which left it vulnerable to hackers. The investigation discovered that BCHP was aware of many of these failures but did not take reasonable steps to address them. In 2023, BCHP participated in an information security audit that identified several data security issues. Those lapses included failing to implement common information security policies and procedures, failing to utilize common standard security tools, and failing to adopt an incident response plan. BCHP also failed to establish a security vendor assessment program and to clearly establish the vendor’s specific security service responsibilities.
In addition, BCHP data security executives knew for at least two years before the breach that BCHP hosted an unencrypted archive containing more than one million patient billing records including personal, medical, and financial information, such as names, addresses, dates of birth, Social Security numbers, and treatment and other billing information. This archive remained largely unprotected until it was stolen in the 2024 breach.
The investigation also found that XTIUM failed to adopt reasonable safeguards to protect data of both customer network data and the personal data of XTIUM employees, 200 of which were New Yorkers and 16 were from Connecticut. Further, it failed to enforce common standards for its IT system and did not have sufficient logging and monitoring in place to detect misuse of its remote support tool account. These protections were so deficient that XTIUM is still unable to confirm how hackers accessed its system.
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 for New York and $260,000 to Connecticut if it violates the terms of the settlement.
In addition to financial penalties, the companies must adopt a series of measures to strengthen their cybersecurity practices, including:
• Maintaining a comprehensive information security program designed to protect customers’ private information;
• Developing and maintaining a data inventory of private information and ensuring the information is protected;
• Maintaining reasonable authentication procedures for access to private information;
• Maintaining a logging and monitoring system as well as reasonable policies and procedures to properly configure systems to send alerts of suspicious activity; and
• Enhancing threat response procedures.
Assistant Attorney General Laura Martella and Deputy Associate Attorney General Michele Lucan, Chief of the Privacy and Data Security Section assisted the Attorney General in this matter.
- Twitter: @AGWilliamTong
- Facebook: CT Attorney General
Media Contact:
Elizabeth Benton
elizabeth.benton@ct.gov
Consumer Inquiries:
860-808-5318
attorney.general@ct.gov