States Fine Pediatric Practice, IT Vendor $2.7M Over Hack | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

The attorneys general of New York and Connecticut have fined Boston Children’s Health Practice and its former third-party IT services vendor XTIUM $2.7 million – and possibly up to $4 million – for a 2024 hack. (Image: BCHP, XTIUM)

A pediatric practice in New York and Connecticut and one of its former IT services vendors will collectively pay those two states financial penalties of $2.7 million for a 2024 hacking incident that affected nearly 900,000 people. See Also: How to implement a physical security strategy with privacy in mind
Boston Children’s Health Physicians and its former vendor Xtium – previously known as Axispoint Technology Solutions Group also pledged to implement a long list of data security program improvements.
More than 300 BCHP doctors practice in over 60 locations in New York and five in Connecticut. The practice is affiliated with Boston Children’s Hospital in Massachusetts. Xtium, which is based in Florida, provided managed IT services to BCHP at the time of the incident.
The settlements with Connecticut and New York state settle investigations from each state into a 2024 hacking incident.
Threat actors in August 2024 hacked into Xtium’s network, initially infiltrating into 18 of the company’s client systems. But of the 18 Xtium clients affected, only BCHP – due to a number of alleged security practice weaknesses – suffered a data breach as a result of the infiltration, investigators found.
Ransomware gang BianLian claimed responsibility for the attack (see: BianLian Ransomware Gang Claims Heist of Pediatric Data).
Hackers stole the records of approximately 825,000 New Yorkers and 62,871 Connecticut residents from BCHP’s network, including Social Security numbers and medical information. They also stole records for about 4,000 BCHP employees.
Under the agreements, BCHP and Xtium will pay a $2.1 million penalty to New York and $540,000 to Connecticut. The settlement does not specify the breakdown of how much BCHP and Xtium are individually responsible for paying.
But if BCHP violates the agreement within 10 years – including its data security program promises – the pediatric practice will pay a second penalty of $1.3 million to the states. That includes $260,000 to Connecticut and $1,040,000 to New York.
The states’ investigation into the incident found a list of security failures by both organizations. That included Xtium failing to adopt reasonable safeguards and not enforcing common standards for its IT system. Investigators said the firm lacked sufficient logging and monitoring to detect misuse of its remote support tool account. “These protections were so deficient that Xtium is still unable to confirm how hackers accessed its system,” Connecticut officials said in a statement.
As for BCHP, the states said it found that the pediatric practice lacked adequate access controls, network segmentation, monitoring and privileged account management. The practice was also unsure at one time whether it or Xtium was providing specific services to secure the BCHP information systems.
Investigators determined that BCHP executives had known for more than two years about an unencrypted archive containing over 1 million patient payment records, including names, addresses, dates of birth, Social Security numbers, medical and treatment information, and other billing information.
This archive remained largely unprotected until it was hacked in the 2024 breach, the states said.
Under the agreements with the states, neither organization admitted nor denied the findings of the investigations.
BCHP in a statement to ISMG said, “while we don’t comment on litigation, we are committed to strong privacy and data security practices.”*
Xtium did not immediately respond to a request for comment.
The agreements with the states require both organizations to strengthen their security programs, appoint qualified security leadership, improve access controls and encryption, and undergo independent security assessments.
The hacking incident was the subject of a $5.15 million civil class action settlement in August 2025 (see: Pediatric Practice, Vendor Settle $5.15M Breach Suit).
*Update Oct. 20, 2026, 19:53 UTC: adds BCHP statement.