A settlement over sensitive records
New York and Connecticut have reached a settlement with Boston Children’s Health Physicians and its information-technology provider, XTIUM, over a 2024 breach of pediatric health records. The two companies will pay penalties described by the attorneys general as totaling nearly $2.7 million and must strengthen their data-security practices.
Hackers accessed the health network through the IT company and stole records concerning approximately 825,000 New York residents and 62,871 Connecticut residents, according to the state investigation. The compromised material included medical and billing information. More than 170,000 New Yorkers had Social Security or driver’s-license numbers involved.
What investigators found
The attorneys general said the pediatric network had not adopted common security policies, incident-response planning and vendor oversight appropriate for the information it held. A 2023 audit had identified multiple weaknesses, but the settlement says the organization did not take reasonable steps to address them.
Investigators also found that an unencrypted archive contained more than one million patient billing records. The network’s security executives had known about the archive for at least two years before it was stolen, the state said. XTIUM, meanwhile, lacked sufficient logging and monitoring around a remote-support account and could not determine how the attackers entered its system.
Financial and operational terms
The companies are to pay $2.1 million to New York and $540,000 to Connecticut. The agreement provides for an additional $1.04 million to New York and $260,000 to Connecticut if Boston Children’s Health Physicians violates the settlement terms.
Required improvements include a comprehensive information-security program, an inventory of private data, reasonable authentication controls, properly configured logs and alerts, and stronger incident-response procedures. Those obligations address both prevention and the ability to detect and contain misuse quickly.
Why vendor oversight matters
Health-care organizations often depend on outside technology companies. That can improve expertise and efficiency, but it does not transfer away responsibility for patient information. A contract should define which party handles access controls, monitoring, backup protection, incident reporting and remediation.
The case illustrates the danger of unclear boundaries. When each organization assumes the other is watching a system, weaknesses can persist. Regulators are signaling that institutions must assess vendors, verify controls and maintain their own understanding of where sensitive records are stored.
Steps for affected families
People who received a breach notice should follow the specific instructions in that notice, consider a credit freeze with the three major credit bureaus and review credit reports for unfamiliar accounts. A freeze is generally stronger than a fraud alert because it restricts new credit from being opened until the consumer lifts it.
Families should also be cautious about messages claiming to offer compensation or protection. Criminals sometimes use public breach information for follow-up phishing. Residents can verify communications through known contact information rather than links in unexpected texts or emails.
The settlement does not erase the exposure or guarantee that stolen data will never be misused. It creates penalties and enforceable security obligations, while affected consumers still need to watch for identity theft and protect records that cannot be changed as easily as a password.
Medical information can create risks beyond ordinary financial fraud because it may reveal diagnoses, treatment history and family relationships. Consumers cannot replace that history as they would replace a payment card. Health networks should therefore minimize how long they retain unnecessary records, encrypt archives and test whether vendors can detect suspicious access before an incident becomes a mass exposure.
Sources: New York Attorney General settlement details. Reporting reviewed October 17, 2026.