On October 16, 2026, New York Attorney General Letitia James and Connecticut Attorney General William Tong announced a settlement with Boston Children's Health Physicians (BCHP) and its IT vendor XTIUM. The case stems from a 2024 breach that the attorneys general say exposed records of about 825,000 New York residents and 62,871 Connecticut residents. Together that is nearly 888,000 people, many of them children and their families. The settlement is announced as $2.7 million, but the itemized penalties are $2.1 million to New York and $540,000 to Connecticut, which adds up to $2.64 million (as Finger Lakes 1 points out). The joint press releases do not account for the gap. Both companies must also adopt stronger security programs. The New York Assurance of Discontinuance (No. 2026-057) records the regulators' findings. Those findings describe a pediatric network that knew about its security gaps for years and did not close them.
What Happened
The attackers got in through the vendor. According to both attorneys general, XTIUM, an IT management company that provided network security services to BCHP, was breached in August 2024. That intrusion gave the attackers access to the networks of 18 XTIUM clients, BCHP among them. They then stole patient records from BCHP's environment.
The sources describe the timing a little differently. The press releases date XTIUM's breach to August 2024, while the New York Assurance calls the BCHP incident "the fall 2024 BCHP data breach." The most likely reading is that XTIUM was compromised in August and the theft from BCHP happened or was found later. The public excerpts do not give an exact timeline. One aggregator, databreachrights.com, lists the discovery and notification dates as not publicly disclosed.
According to the Assurance, BCHP has more than 300 doctors practising at over 60 locations in New York and five in Connecticut. Hoodline describes BCHP as a Valhalla-based multi-specialty pediatric group affiliated with Boston Children's Hospital, citing BankInfoSecurity. BCHP is a HIPAA covered entity. Even so, the Assurance says only two BCHP employees oversaw all IT and information security when the breach happened. Most IT functions were outsourced to two different vendors.
Settlement terms reported so far:
- $2.1 million penalty to New York and $540,000 to Connecticut
- Suspended penalties of $1.04 million (New York) and $260,000 (Connecticut), payable if BCHP fails to carry out the required reforms (reported by Hoodline, citing the New York AG)
- A required comprehensive information security program, plus an inventory of private information and protections for it (Finger Lakes 1)
What Was Taken
The two attorneys general give the following figures, and local coverage from Patch, Finger Lakes 1 and Hoodline repeats them:
- ~825,000 New York residents affected
- 62,871 Connecticut residents affected
- More than 170,000 New Yorkers had Social Security numbers and driver's license numbers exposed (New York AG)
The worst failure the investigators identified was an unencrypted archive of more than 1 million patient billing records. Executives had known about it for at least two years before the breach (Finger Lakes 1, Patch). The archive held names, addresses, dates of birth, Social Security numbers, medical treatment information and financial records. Investigators said it stayed "largely unprotected until it was stolen." The archive held over 1 million records while about 888,000 people are reported as affected. The sources do not explain the difference, though duplicate or out-of-state records are a likely cause.
According to Finger Lakes 1, investigators also found that personal data for about 200 XTIUM employees in New York was put at risk.
Some secondary coverage conflicts with this. Databreachrights.com says the exposed data types and number of people affected were "not publicly disclosed." The attorneys general's own announcements contradict that, so this brief relies on the official figures. Shattered.io describes the victims as "tens of thousands of patients," which only matches the Connecticut figure and badly understates the New York total.
Why It Matters
Pediatric data lasts a long time. A child's Social Security number may not be used for credit for a decade or more. That gives fraudsters a long window to build synthetic identities before anyone notices. Medical and billing records cannot be reissued the way a payment card can.
Regulators blamed the client as well as the vendor. XTIUM was the entry point, but the attorneys general focused on what BCHP knew. Attorney General James said BCHP "knew its data security features were inadequate but did not fix them." According to Finger Lakes 1 and Patch, a 2023 audit had already flagged missing security policies, missing standard security tools, the lack of an incident response plan, and weak oversight of what the outside vendor was responsible for. Once you have an audit report in hand, regulators treat continued inaction as your liability, not just a risk.
One MSP compromise reached 18 organisations. This is the familiar managed service provider (MSP) pattern: compromise one provider and you reach many of its clients. Organisations that outsource IT also inherit their vendor's security posture. If no one in-house checks that posture, outsourcing does not move the risk anywhere else.
The legal basis reaches beyond HIPAA. New York investigated under Executive Law § 63(12), the state SHIELD Act (GBL § 899-bb), and the HIPAA Privacy and Security Rules. Any covered entity serving New Yorkers faces state enforcement that runs alongside federal HHS oversight.
The Attack Technique
The public record does not say how the attackers got in. According to Finger Lakes 1, investigators could not determine how the hackers initially accessed XTIUM's systems. They did find that XTIUM lacked adequate safeguards and monitoring for its remote-support tool. Remote-support and RMM platforms are a common route into MSP clients because they come with privileged access to every managed network.
Shattered.io says the attackers "moved laterally across the shared infrastructure" from XTIUM into client environments. The official announcements confirm that 18 client networks were accessed, but they do not describe the mechanism, so treat the lateral-movement account as that outlet's interpretation. No source names a threat actor or ransomware group, says whether there was an extortion demand, or names any malware.
After that, the attackers did not need much skill to steal the data. The billing archive with more than 1 million records was unencrypted and, by the investigators' account, largely unprotected.
What Organizations Should Do
- Treat MSP remote access as a top-tier risk. Inventory every remote-support and RMM tool that vendors can use on your network. Require MFA, restrict access by IP or device, and send session logs to a SIEM you control. Insist on alerts for out-of-hours or unusual vendor sessions.
- Fix what your auditors already found. Track every audit finding to closure, with an owner and a deadline. In this case the 2023 audit became evidence against the company in an enforcement action.
- Find and encrypt legacy data stores. Inventory sensitive data, including old billing exports and archives. Encrypt it at rest, restrict access to it, and delete what you no longer need. An archive of more than 1 million records that nobody uses is a liability with no business value.
- Write vendor responsibilities into contracts and verify them. Spell out which security controls the vendor runs and which you run, require breach notification within hours, and review compliance on a regular schedule. The investigators faulted BCHP for weak oversight of what its vendor was responsible for.
- Have and test an incident response plan. The 2023 audit found BCHP had none. Run tabletop exercises with your MSP that cover a scenario where the vendor itself is compromised.
- Staff security to match the data you hold. Two people overseeing IT security for a 300-plus-physician HIPAA covered entity was not enough. If you cannot hire, pay for independent oversight rather than relying only on the vendor you need to oversee.
Sources: Letitia James - New York Attorney General | attorney general of the state of new york | Attorney General Tong and Attorney General James Secure Settlement... | Boston Children's Health Physicians Pays $2.7M NY Data Breach Fine | Pediatric health network, vendor to pay New York $2.1 million after... | Medical Records, Social Security Numbers Stolen In ... | BCHP Data Breach: $2.7M Settlement Over Data Exposure | CT Medical Data Breach Hits 62871, Costs $2.7M 2026