INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

NY AG James and CT AG Tong Secure $2.7 Million

| 2026-10-17 22:22 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
In August 2024, hackers accessed the networks of 18 XTIUM clients, including Boston Children's Health Physicians (BCHP), a New York-based pediatric health network. Hackers stole records from approximately 825,000 New York and 62,871 Connecticut residents, including Social Security numbers and driver's license information for over 170,000 New York residents. As part of a settlement, BCHP will pay $2.1 million to New York and $540,000 to Connecticut, while XTIUM will also contribute financially; the companies have agreed to adopt stronger security policies to protect private data. An investigation by Attorneys General James and Tong found that BCHP failed to implement common information security policies and procedures, leaving its customers' personal data at risk, despite being aware of these failures for at least two years prior to the breach in 2024.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope healthhealth
Incident Timeline
‎August 2024
Hackers accessed approximately 825,000 New York and 62,871 Connecticut residents' records through XTIUM's breach in August 2024.
organisation BCHP’s
In August 2024, XTIUM suffered a breach that allowed hackers to access 18 of its clients’ networks, including BCHP’s.
general_metric 18 hackers
In August 2024, XTIUM suffered a breach that allowed hackers to access 18 of its clients’ networks, including BCHP’s.
organisation the Social Security
Hackers stole the records of approximately 825,000 New York and 62,871 Connecticut residents from BCHP’s network, including the Social Security and driver’s license numbers of over 170,000 New York residents.
organisation the Office of the New York
In coordination with our partners in the Office of the New York Attorney General, we are holding BCHP and their security vendor accountable.”
organisation Social Security
In addition, BCHP data security executives knew for at least two years before the breach that BCHP hosted an unencrypted archive containing more than one million patient billing records including personal, medical, and financial information, such as names, addresses, dates of birth, Social Security numbers, and treatment and other billing information.
organisation the Bureau of Internet and Technology
This matter was handled for New York by Assistant Attorney General Gena Feist and Deputy Bureau Chief Clark Russell of the Bureau of Internet and Technology, under the supervision of Bureau Chief Kim Berger.
The Bureau of Internet and Technology is a part of the Division for Economic Justice, which is led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Meghan Faux.
organisation the Division for Economic Justice
The Bureau of Internet and Technology is a part of the Division for Economic Justice, which is led by Chief Deputy Attorney General Chris D’Angelo and overseen by First Deputy Attorney General Meghan Faux.
organisation Data Security
Data Security Analyst Nishaant Goswamy of the Research and Analytics Department also assisted on the matter.
organisation the Research and Analytics Department
Data Security Analyst Nishaant Goswamy of the Research and Analytics Department also assisted on the matter.
financial $2.1 penalty
As part of a settlement, the companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut and adopt stronger security policies to protect private data.
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
financial $540,000 York
As part of a settlement, the companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut and adopt stronger security policies to protect private data.
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
financial $1,040,000 BCHP
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
financial $260,000 York
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
victims 200 employees
The investigation also found that XTIUM failed to adopt reasonable safeguards to protect data of both customer network data and the personal data of XTIUM employees, 200 of which were New Yorkers.
‎2026/10/17
Threat actors used a data breach to expose hundreds of thousands of private information records, prompting New York AG James and Connecticut AG Tong to secure $2.7 million from BCHP and XTIUM for failing to protect the sensitive data.
financial $2.7 Tong Secure
New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a New York-based pediatric health network, and XTIUM, an IT management company that provided network security services to BCHP , for failing to protect the private information of hundreds of thousands of New York and Connecticut reside…
organisation BCHP
New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a New York-based pediatric health network, and XTIUM, an IT management company that provided network security services to BCHP , for failing to protect the private information of hundreds of thousands of New York and Connecticut reside…
‎2026/10/17
NY AG James and CT AG Tong secured $2.7 million from Boston Children's Health Physicians and XTIUM for a 2024 data breach.
organisation Data Breach
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach.
organisation NY AG
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach.
organisation CT AG
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach.
organisation Boston Children’s Health Physicians
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach.
organisation XTIUM
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach.
financial $2.7 Tong Secure
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach.
Tactical Metrics
Metrics
financial
2,700,000
Tong Secure
NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach.
New York Attorney General Letitia James and Connecticut Attorney General William Tong today secured $2.7 million from Boston Children’s Health Physicians (BCHP), a New York-based pediatric health network, and XTIUM, an IT management company that provided network security services to BCHP , for failing to protect the private information of hundreds of thousands of New York and Connecticut reside…
Metrics
financial
2,100,000
Penalty
As part of a settlement, the companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut and adopt stronger security policies to protect private data.
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
Metrics
financial
540,000
Financial Impact / Stolen Funds
As part of a settlement, the companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut and adopt stronger security policies to protect private data.
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
Metrics
victims
200
Employees
The investigation also found that XTIUM failed to adopt reasonable safeguards to protect data of both customer network data and the personal data of XTIUM employees, 200 of which were New Yorkers.
Metrics
financial
1,040,000
Financial Impact / Stolen Funds
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
Metrics
financial
260,000
Financial Impact / Stolen Funds
As a result of the investigation, BCHP and XTIUM will pay a $2.1 million penalty to New York and $540,000 to Connecticut, and BCHP must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement.
Intelligence Sources
Data Breaches 2026-10-17