Connecticut to receive $540K from Boston Children's Health Physicians and XTIUM after data breach

Connecticut will receive a sum of $540,000 from two companies as part of a multi-state settlement stemming from a data breach in August 2024.

Hackers gained access to the personal information of hundreds of thousands of people, according to an announcement made by Connecticut Attorney General William Tong Friday afternoon.

The settlement was secured by both Tong and New York Attorney General Letitia James from Boston Children's Health Physicians, or BCHP, and XTIUM. It totals $2.7 million, with approximately $2.1 million going to New York.

BCHP is a New York-based pediatric health network, while XTIUM is an IT management company that was responsible for providing security services to BCHP when the data leak occurred.

In August 2024, XTIUM suffered a data breach in which hackers accessed 18 of its clients' networks, with BCHP being among them.

These criminals stole the records of approximately 825,000 New Yorkers and 62,871 people in Connecticut who were part of BCHP's network.

The compromised information included Social Security numbers and medical information.

A report from Tong's office notes that BCHP didn't reasonably manage its vendor-based security program or adopt standard security standards, which made it vulnerable to hackers.

Investigators say that BCHP knew of these failures but didn't address them. The company didn't put in place common information security policies and procedures, failed to use common standard security tools and chose not to adopt an incident response plan.

BCHP further failed to create a security vendor assessment program, nor did it clearly establish the vendor's specific security service responsibilities.

The attorneys general revealed that BCHP data security executives were aware of these shortcomings for several years before the breach in the summer of 2024.

The breach ultimately allowed hackers to access more than a million billing records that included personal, medical and financial information such as places of birth and addresses.

The archive was said to be largely unprotected until after the 2024 data breach.

Meanwhile, investigators say the XTIUM didn't adopt reasonable safeguards to protect customer network data and personal data of its employees; 200 were from New York, and 16 came from Connecticut.

The company also didn't enforce common standards pertaining to its IT system and failed to have sufficient logging and monitoring implemented to detect misuse of its remote support tool account.

The report from Tong's office notes that the protections were so poorly put in place that XTIUM still doesn't know how the hackers accessed its system.

Following the agreement, if BCHP violates the settlement's terms, it must pay an additional $1,040,000 to New York and $260,000 to Connecticut.

Furthermore, the companies must establish a series of measures to enhance their cybersecurity practices to ensure a similar attack is rebuffed time.

In Tong's report, both he and James on the settlement that was reached.

Tong points out that BHCP collected deeply sensitive information from pediatric clients and families and should have gone above and beyond to protect it.

"They had an obligation to safeguard those records, and they failed," Tong said. "In coordination with our partners in the New York Office of the Attorney General, we are holding BCHP and their security vendor accountable."

James notes that BCHP was aware of the flaws in its systems but refused to act upon that knowledge.

"[This] exposed the information of hundreds of thousands of New Yorkers to hackers," James said. "As a result of our investigation, we are holding BCHP accountable and ensuring they implement new measures to protect New Yorkers' personal information."

Dalton Zbierski is a digital editor and writer at FOX61 News. He can be reached at dzbierski@FOX61.com .

Do you have a story idea or something on your mind you want to ? We want to hear from you! Email us at [email protected] .