Hackers reached 18 of the vendor's client networks in August 2024, and records on about 888,000 people were taken from one of them.

 

What happened

Boston Children's Health Physicians, a New York-based pediatric health network, and XTIUM, the IT management company that provided its network security services, will pay $2.7 million to New York and Connecticut over a 2024 data breach, the New York Attorney General announced on October 16, 2026. XTIUM was breached in August 2024, and the attackers used that access to reach 18 of its clients' networks, including the pediatric network's. Records belonging to about 825,000 New York residents and 62,871 Connecticut residents were taken, including Social Security and driver's license numbers for more than 170,000 New Yorkers. The companies will pay $2.1 million to New York and $540,000 to Connecticut, and must adopt stronger security measures.

 

Going deeper

The attorneys general found that the pediatric network had taken part in a security audit in 2023 that identified several problems, including missing security policies, standard security tools that weren't in use, and no incident response plan. The investigation also found that the network had not set up a program for assessing its vendors or clearly defined which security services XTIUM was responsible for. For at least two years before the breach, data security staff were aware of an unencrypted archive holding more than one million patient billing records, covering names, addresses, dates of birth, Social Security numbers, and treatment details, according to the findings. On XTIUM's side, investigators found insufficient logging and monitoring to detect misuse of its remote support tool account, and the company still cannot confirm how the attackers got into its systems.

 

What was said

"Institutions trusted with sensitive private health data have a critical responsibility to protect it from bad actors," said New York Attorney General Letitia James in the announcement. Connecticut Attorney General William Tong said the network "collected deeply sensitive information from their pediatric patients and their families." Under the settlement, the pediatric network would owe a further $1.04 million to New York and $260,000 to Connecticut if it breaks the agreement's terms.

 

In the know

Managed service providers, the companies that run IT systems for other organizations, have been a known route into their customers' networks for years. CISA, the NSA, the FBI, and agencies in four other countries warned in a joint advisory that attackers were increasingly targeting these providers to reach the organizations they serve, in advisory AA22-131A. The advisory tells customers to set clear security expectations with their provider, understand what access the provider has to their network and data, and write the required security measures into the contract. It also recommends keeping important logs for at least six months, which was directly related to XTIUM's case, where missing logs left the company unable to say how the intrusion began.

 

The big picture

The unencrypted billing archive is the part of this case that changed what the breach meant for patients. Under HIPAA, notification duties apply only to unsecured protected health information, and HHS names encryption and destruction as the two methods that make health information secure, according to its breach notification guidance. Encrypted data taken from a system can fall outside the notification requirement, while unencrypted records stolen the same way cannot. The settlement now requires both companies to keep an inventory of the private information they hold and make sure it is protected. Old billing archives are a common place for unencrypted records to sit unnoticed, since they are no longer used day to day and tend to drop out of the reviews that cover active systems.

 

FAQs

Why did a breach at an IT vendor become the health network's responsibility?

The network held the patient data, and the attorneys general found it had not managed its vendor's security responsibilities or set up a vendor assessment program. Contracting out IT work does not transfer the obligation to protect the data.

 

What is a remote support tool?

Software that lets IT staff access and control computers from another location. It is useful for managed services, and for the same reason a misused account can give an attacker wide access.

 

Does encryption mean a breach never has to be reported?

Encryption that meets HHS guidance can mean stolen data is not "unsecured," which affects whether notification is required. The decryption keys have to be kept separately, since encryption offers no protection if the attacker also has the key.

 

What does a data inventory involve?

A record of what private information an organization holds, where it is stored, and how it is protected. Without one, archives and old copies are easy to miss in security reviews.

 

What should a practice check with its IT provider?

Which security services the provider is responsible for, what access it has, how that access is logged and monitored, and whether these points are written into the contract.