A New York pediatric health network and its IT vendor must pay millions of dollars after hackers stole the private records of hundreds of thousands of people.
Boston Children’s Health Physicians (BCHP) and XTIUM failed to protect patient data taken in an August 2024 breach of the IT firm’s systems, say New York Attorney General Letitia James and Connecticut Attorney General William Tong.
The breach gave hackers access to 18 XTIUM client networks, including BCHP’s.
The hackers stole the records of about 825,000 New York residents and 62,871 Connecticut residents from BCHP’s network, including the Social Security and driver’s license numbers of more than 170,000 New Yorkers.
The attorneys general say BCHP knew for at least two years before the breach that an unencrypted archive holding more than one million patient billing records was largely unprotected.
A 2023 security audit had also flagged several data security problems at BCHP.
Investigators found XTIUM lacked the logging and monitoring needed to catch misuse of its remote support tool account, and the company still cannot confirm how the hackers got in.
Under the settlement, the companies will pay a $2.1 million penalty to New York and $540,000 to Connecticut.
BCHP must pay another $1.04 million to New York and $260,000 to Connecticut if it violates the terms.
Both firms must also run a full information security program, keep an inventory of private data, tighten authentication, set up logging with alerts for suspicious activity and improve threat response.
Says James,
“Institutions trusted with sensitive private health data have a critical responsibility to protect it from bad actors. BCHP knew its data security features were inadequate but did not fix them, exposing the information of hundreds of thousands of New Yorkers to hackers. As a result of our investigation, we are holding BCHP accountable and ensuring they implement new measures to protect New Yorkers’ personal information.”
Says Tong,
“BCHP collected deeply sensitive information from their pediatric patients and their families. They had an obligation to safeguard those records, and they failed. In coordination with our partners in the Office of the New York Attorney General, we are holding BCHP and their security vendor accountable.”
BCHP previously agreed to a $5.15 million class action settlement over a 2024 cyberattack at its IT services provider.
Follow us on X, Facebook and Telegram
Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
 
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: Midjourney
Be the first to comment