Medical Records, Social Security Numbers Stolen In Breach Affecting Nearly 63K CT Residents

Nearly 63,000 Connecticut residents had sensitive personal information stolen in a data breach involving a pediatric health network, including Social Security numbers and medical records, according to Attorney General William Tong.

Boston Children's Health Physicians, a New York-based pediatric health network, and XTIUM, an IT management company, have agreed to pay $2.7 million in penalties to Connecticut and New York for failing to protect private information, Tong announced Friday.

Subscribe

The breach occurred in August 2024, when hackers gained access to 18 networks serviced by XTIUM, including Boston Children's Health Physicians. Hackers stole records belonging to 62,871 Connecticut residents and approximately 825,000 New Yorkers, according to the attorney general's office.

"BCHP collected deeply sensitive information from their pediatric patients and their families. They had an obligation to safeguard those records, and they failed," Tong said in a statement.

An investigation by Tong and New York Attorney General Letitia James found that the pediatric health network failed to implement basic cybersecurity protections, despite knowing about vulnerabilities before the breach.

A 2023 security audit identified several weaknesses, including inadequate security procedures, missing safeguards and the absence of an incident response plan, according to the investigation.

Investigators also found that company executives knew for at least two years before the breach that the network maintained an unencrypted archive containing more than one million patient billing records.

The archive included names, addresses, dates of birth, Social Security numbers, medical treatment information and financial records.

Under the settlement, the companies will pay $540,000 to Connecticut and $2.1 million to New York.

Boston Children's Health Physicians could face an additional $260,000 penalty in Connecticut and $1.04 million in New York if it violates the settlement terms.

The companies must also strengthen their cybersecurity practices, including implementing comprehensive data protection programs, improving access controls, monitoring suspicious activity and enhancing their response to potential security threats.