NY Pediatric Practice; IT Vendor Pay States $2.7M Over 2024 Hacking Incident
Boston Children’s Health Physicians (BCHP), a pediatric medical practice with locations in New York and Connecticut, and XTIUM, BCHP’s former managed IT service provider, have agreed to settle a state investigation into a cybersecurity incident and data breach that affected nearly 900,000 individuals in New York and Connecticut. Collectively, BCHP and XTIUM will pay $2,700,000 to the states under the settlement agreement and will update their information security programs and adhere to cybersecurity best practices. A further $1,300,000 penalty has been suspended.
Florida-based XTIUM, formerly Axispoint Technology Solutions Group, was contracted with BCHP to provide managed IT services at the time of the cybersecurity incident. New York-based BCHP is affiliated with Boston Children’s Hospital in Massachusetts and operates more than 60 pediatric medical practices in New York state and five in Connecticut.
In August 2024, a threat actor (BianLian) breached XTIUM’s network, gained access to the systems of 18 of its clients, and exfiltrated sensitive data. The threat actor obtained the personal data of approximately 4,000 XTIUM employees, and the files exfiltrated from BCHP’s systems included the personal and protected health information of 825,000 New York residents and 62,871 Connecticut residents. Sensitive data stolen in the incident included names, contact information, medical information, and Social Security numbers.
The investigation was led by the New York Attorney General and sought to determine whether the two entities were compliant with the HIPAA Rules and state laws. The investigation determined that the threat actor exploited security weaknesses to breach the XTIUM network and access BCHP systems, and those security failures constituted violations of the HIPAA Security Rule and New York Executive Law.
Specifically, XTIUM failed to implement reasonable safeguards and did not enforce common security standards for its IT systems. There was insufficient logging and a lack of monitoring, to such an extent that it was not possible to detect misuse of the remote support tool account that the threat actor compromised.
BCHP did not implement adequate access controls, network segmentation, monitoring, and privileged account management, and could not confirm whether XTIUM was responsible for securing certain BCHP systems. BCHP had undergone a third-party security audit in 2023, which flagged security issues that were not addressed. For instance, over 1 million records were stored in an unencrypted archive, which was exfiltrated by the threat actor two years later. For two years, individuals at BCHP with responsibility for security were aware that the archive was unencrypted.
BCHP and XTIUM have both agreed to update their information security programs, implement and maintain a range of cybersecurity measures, and follow industry-standard best practices. The $2,700,000 financial penalty will be divided between New York ($2.1 million) and Connecticut ($540,000), and the suspended $1,300,000 will be payable – New York ($1,040,000) and Connecticut ($260,000) – if BCHP violates the settlement agreement.
