BCHP / XTIUM 2024 healthcare data breach — $2.7M NY/CT settlement
Severity: medium · Patch status: no-fix-needed · Since 2026-10-17
New York AG Letitia James and Connecticut AG William Tong secured $2.7 million from Boston Children's Health Physicians (BCHP) and its IT vendor XTIUM over a 2024 data breach. Notably, both the healthcare provider and its IT services company were held liable, underscoring that organizations remain accountable for their vendors' security failures. The settlement includes a corrective action plan requiring improved data security practices. Affected individuals are BCHP patients whose data was exposed in the breach; the sources do not specify the number of affected individuals or the exact data types. No new exploitation is reported; the incident is now resolved via settlement and mandated remediation.
What to do
- Review vendor and business-associate agreements to ensure security obligations and breach liability are explicit
- Assess third-party IT providers' security posture and incident response capabilities
- Review state AG enforcement trends on vendor liability in breach settlements
- Ensure breach notification and patient communication procedures meet NY/CT requirements
- Implement or verify a corrective action plan covering data security controls
Sources
All live incidents on Threat Watch
