NY and Connecticut fine a pediatric network and its IT provider $2.7m

NY and Connecticut fine a pediatric network and its IT provider $2.7m

16 October 2026: New York Attorney General Letitia James and Connecticut Attorney General William Tong have secured $2.7 million from Boston Children's Health Physicians (BCHP), a New York pediatric network, and XTIUM, the IT management company that ran its network security, over a 2024 breach that exposed the records of about 825,000 New Yorkers. The settlement holds the IT provider accountable alongside its client.

Not yet independently verified. The findings are the attorneys general's; the settlement does not record either company's response, and XTIUM itself still cannot say how the attackers got in. We will update this when it can be confirmed, and remove this note.

What went wrong at the provider

In August 2024 XTIUM suffered a breach that let attackers into 18 of its clients' networks, including BCHP's. The investigation found that XTIUM had not adopted reasonable safeguards for its customers' network data or its own employees' data, did not enforce common standards for its IT systems, and lacked enough logging and monitoring to detect misuse of its remote support tool account. Those protections were so deficient, the attorneys general say, that XTIUM "is still unable to confirm how hackers accessed its system."

What went wrong at the client

BCHP failed to manage its vendor-based security programme reasonably or adopt standard protections. A 2023 security audit had identified several data security issues, and BCHP's security executives knew for at least two years before the breach that it hosted an unencrypted archive of more than one million patient billing records, with names, addresses, dates of birth, Social Security numbers and treatment details. That archive stayed largely unprotected until it was stolen. About 62,871 Connecticut residents were also affected.

"BCHP knew its data security features were inadequate but did not fix them," James said. Tong said the two offices were "holding BCHP and their security vendor accountable."

The penalty and the required controls

The companies will pay $2.1 million to New York and $540,000 to Connecticut, and BCHP must pay a further $1,040,000 to New York and $260,000 to Connecticut if it breaks the settlement terms. Both must maintain a comprehensive information security programme, keep an inventory of private information and protect it, use reasonable authentication for access to it, and run logging and monitoring that alerts on suspicious activity.

For any organisation that outsources IT, the case is a practical checklist: ask a managed service provider how its remote support tools are secured and logged, set out in the contract who is responsible for which controls, and do not assume that handing security to a vendor transfers the regulatory risk. In this settlement, both sides paid.

Sources

• New York Attorney General: Attorney General James and Attorney General Tong secure $2.7 million from pediatric health network and IT company, 16 October 2026