New York says weak safeguards exposed records belonging to about 825,000 residents, including Social Security or driver’s license numbers in more than 170,000 records
A pediatric health data breach settlement will require Boston Children’s Health Physicians and its technology vendor, XTIUM, to pay about $2.7 million and strengthen their security after hackers stole medical, financial and identity information belonging to hundreds of thousands of New Yorkers.
The settlement announced Friday, October 16, by New York Attorney General Letitia James and Connecticut Attorney General William Tong follows an August 2024 attack that spread through XTIUM’s systems into 18 client networks. According to New York’s investigation, Boston Children’s Health Physicians was the only client whose intrusion resulted in a confirmed client data breach.
The state says approximately 825,000 New York residents’ records were taken. More than 170,000 of those records included Social Security numbers, driver’s license numbers or both. The affected material also included names, addresses, dates of birth, health insurance information, billing information and treatment information.
For parents and guardians, the practical message is simple: a child’s information can be valuable to identity thieves even when the child has no credit card or bank account. A breach notice should not be ignored, and protective steps may need to continue well beyond a free monitoring period.
Pediatric health data breach began through an IT vendor
The state’s 26-page Assurance of Discontinuance describes how the attack moved from an outside technology provider into a pediatric medical network.
XTIUM, formed through the merger of Axispoint Technology Solutions Group and Evolve IP, provided managed technology services to Boston Children’s Health Physicians. The practice operates at more than 60 New York locations and five Connecticut locations, with a network of more than 300 doctors, according to the settlement.
New York’s findings say a threat actor entered XTIUM in August 2024 through a remote-support tool. XTIUM allegedly did not use all security protections recommended by the tool’s vendor and lacked enough logging and monitoring to determine exactly how the attackers first gained access.
XTIUM notified the pediatric network of its own breach on September 6, 2024. The health network reset user passwords the following day, according to the settlement, but did not immediately reset all system and administrator passwords or isolate the network from the internet. On September 10, the practice detected unauthorized activity and cut internet access while investigating. The system was restored by September 13.
The active patient-record system, managed by a different vendor, was not breached, the settlement says. Attackers instead reached other systems and removed an unencrypted archive of patient billing records.
New York says warnings were not adequately addressed
The Attorney General’s investigation found that Boston Children’s Health Physicians completed a third-party security audit in 2023. That audit identified missing security policies, unclear divisions of responsibility with XTIUM, absent security tools, no incident-response plan and no vendor-assessment program.
Investigators also said security executives knew for at least two years that an unencrypted archive held more than one million patient payment records. The archive remained largely unprotected until it was stolen in 2024, according to the state.
“Institutions trusted with sensitive private health data have a critical responsibility to protect it from bad actors,” James said. She said the investigation is holding the organizations accountable and requiring stronger safeguards.
Tong said the medical network collected deeply sensitive information from pediatric patients and families and had an obligation to protect it.
Boston Children’s Health Physicians and XTIUM cooperated with the investigation. Under the formal settlement language, the companies neither admit nor deny the Attorney General’s findings.
What the $2.7 million settlement requires
The companies will pay $2.1 million to New York and $540,000 to Connecticut. The agreement also provides for additional payments of $1.04 million to New York and $260,000 to Connecticut if Boston Children’s Health Physicians violates the settlement terms.
Required security changes include:
- A comprehensive information-security program for private customer information.
- An inventory showing what private information is held and how it is protected.
- Reasonable authentication controls for access to sensitive information.
- Logging, monitoring and correctly configured alerts for suspicious activity.
- Improved threat-response policies and procedures.
The settlement record says affected people were notified as required by state and federal law and were offered one year of free credit monitoring. Anyone who received a notice should check the exact enrollment deadline and coverage terms in that notice. The agreement does not say that a general new enrollment window is open now.
Why Mohawk Valley families should pay attention
The practice is based outside the immediate Utica area, but the case affects New Yorkers statewide and offers a warning for every family that uses a medical network, laboratory, pharmacy, insurer or specialist with centralized digital records.
Patients may not know which outside companies manage a provider’s billing files, support systems or network access. A breach can begin at a vendor and still expose information held by a health practice. That is why the settlement focuses not only on technical controls but also on vendor oversight and clear assignment of security duties.
Children face a special risk because identity theft can remain hidden for years. A criminal may try to use a child’s Social Security number to open an account, seek employment, obtain services or create a false identity record. The problem may not be discovered until the child is older and applies for credit, financial aid, housing or a job.
The Phoenix’s credit-freeze guide for New Yorkers explains the three-bureau process and how adults can protect their own files. Parents should note that freezing a minor’s file can require additional identity and guardianship documents.
What this means for you
If your family received a breach notice
- Confirm the notice is real. Use a phone number or website independently verified through the medical provider, not an unexpected link in a text message.
- Identify whose information was exposed. A notice may name a patient, parent, guarantor or employee. Check whether Social Security, insurance, driver’s license, billing or treatment information was involved.
- Enroll in legitimate monitoring before the deadline. Do not pay anyone to activate a benefit that the provider offered for free.
- Save the letter. Keep the notice, enrollment confirmation and any later fraud reports together.
- Review insurance explanations of benefits. Contact the insurer and provider if you see treatment, prescriptions or claims that do not belong to your family.
Consider a child credit freeze
A security freeze can make it harder for someone to open a new credit account using a child’s identity. Federal Trade Commission guidance explains how parents and guardians can protect a child from identity theft. Contact Equifax, Experian and TransUnion separately because a freeze with one bureau does not automatically cover the other two.
If identity theft has already occurred, use the federal government’s IdentityTheft.gov recovery service to create a personalized plan. A police report may also be useful when a creditor, insurer or government agency asks for documentation.
Watch for follow-up scams
Breaches often create opportunities for phishing. A caller may know a patient’s name, provider or partial personal details and use that knowledge to sound legitimate. Do not provide a full Social Security number, password or one-time login code to an unexpected caller.
Be especially careful with messages that claim immediate payment is required to protect a medical account. Contact the provider through a number printed on a bill, insurance card or verified official website.
Questions patients should ask health providers
- Which vendors can access patient or billing information?
- Is old information deleted when there is no legal or medical need to retain it?
- Are sensitive archives encrypted?
- Does the provider test its incident-response plan?
- How quickly will families be notified after a confirmed breach?
- Who should patients contact about suspicious claims or identity misuse?
A family cannot control a medical network’s cybersecurity. It can, however, keep contact information current, read breach notices, use free freezes and monitoring, review insurance statements and report suspicious activity quickly.
Did your family receive a notice connected to this breach? Share which parts of the response process were clear or confusing, but do not post medical details, account numbers, birth dates or other identifying information in a public comment.
