Skip to content
Data Breach Exposes Medical Records of 825,000 New Yorkers and 63,000 Connecticut Residents

Data Breach Exposes Medical Records of 825,000 New Yorkers and 63,000 Connecticut Residents

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 16:38 UTC
  • •BCHP and XTIUM's breach affected 825,000 New Yorkers and 62,871 Connecticut residents.
  • •The breach resulted from inadequate cybersecurity measures and known vulnerabilities.
  • •The companies will pay $2.7 million in penalties and must improve their security practices.

Boston Children's Health Physicians (BCHP) and its IT provider XTIUM have agreed to pay $2.7 million after a data breach in August 2024 exposed sensitive personal information of approximately 825,000 New Yorkers and 62,871 Connecticut residents. The breach occurred when hackers accessed 18 networks serviced by XTIUM, stealing records that included Social Security numbers and medical information. An investigation revealed that BCHP failed to implement basic cybersecurity measures and was aware of its vulnerabilities prior to the breach. A 2023 security audit identified significant lapses in data security, including inadequate security policies and the maintenance of an unencrypted archive containing over one million patient records. As part of the settlement, BCHP and XTIUM must strengthen their cybersecurity practices and could face additional penalties if they violate the terms.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 4h ago How this analysis works

Timeline

2024-08-01
Data breach occurred
Hackers accessed 18 networks serviced by XTIUM, compromising sensitive records of BCHP's patients.
Ag.Ny
2026-10-16
Settlement announced
BCHP and XTIUM agreed to pay $2.7 million in penalties for failing to protect sensitive data.
Ag.Ny
2026-10-17
Settlement details released
Connecticut AG Tong confirmed the breach affected nearly 63,000 residents and outlined the settlement terms.
Patch

More articles in this cluster (3)

Following this threat?

Track Boston Children's Health Physicians in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 3

Common questions

How many residents were affected?
Approximately 825,000 New Yorkers and 62,871 Connecticut residents had their sensitive information exposed.
What penalties were imposed?
BCHP and XTIUM agreed to pay a total of $2.7 million in penalties and must implement stronger cybersecurity measures.
What vulnerabilities were identified?
The investigation found inadequate security policies, missing safeguards, and an unencrypted archive containing over one million patient records.