Skip to content
Sign in
Technology · North America

Boston Children’s Health Physicians and XTIUM agree to pay $2.64 million

Boston Children's Health Physicians and XTIUM agreed to pay New York and Connecticut penalties over a breach that exposed records belonging to about 825,000 New Yorkers and 62,871 Connecticut residents, according to the attorneys general. FingerLakes1 reports the combined amount as $2.64 million: $2.1 million to New York and $540,000 to Connecticut.

AI-assisted synthesis · Based on 4 outlets' reporting · Full text read from 2 of 4 outletsHow it's made

View timeline · 2 entries
4 outletsLatest reporting 3 min read
Coverage: Center OnlyL 0 · C 4 · R 0

What happened

Key facts

  • Boston Children's Health Physicians and XTIUM agreed to pay penalties to New York and Connecticut over a data breach (per fingerlakes1.com, patch.com, mlex.com).
  • The combined penalties total $2.64 million according to the detailed amounts reported by FingerLakes1, while Patch and the Hoodline and MLex headlines describe the total as $2.7 million.
  • The attorneys general said hackers accessed XTIUM systems and 18 client networks, including Boston Children's Health Physicians' network (per fingerlakes1.com).
  • Investigators said the compromised archive contained more than 1 million patient billing records, including names, addresses, birth dates, Social Security numbers, and medical and financial information (per fingerlakes1.com, patch.com).
  • Investigators found that XTIUM lacked adequate safeguards and monitoring for its remote-support tool, but could not determine how hackers entered its system (per fingerlakes1.com, patch.com).
  • Investigators found that personal data belonging to 200 XTIUM employees in New York was also at risk (per fingerlakes1.com).

The brief

Patch and the Hoodline and MLex headlines put the total at $2.7 million, a rounded figure. The settlement also requires the pediatric network and its technology vendor to strengthen data protections. The breach occurred in 2024.

The attorneys general said hackers accessed XTIUM's systems and 18 client networks, including Boston Children's Health Physicians' network, and took records from the practice. FingerLakes1 specifies that the access occurred in August 2024. The stolen records included patient billing information, and the exposed data affected residents in both states.

Investigators said the compromised archive held more than 1 million patient billing records. The records included identifying details such as names, addresses and birth dates, alongside Social Security numbers and medical and financial information. FingerLakes1 also reports that personal data belonging to 200 XTIUM employees in New York was at risk.

The findings described by FingerLakes1 point to security weaknesses at both the practice and its vendor. Investigators said executives knew for at least two years before the breach that the archive was unencrypted and remained largely unprotected. They also found that XTIUM lacked adequate safeguards and monitoring for its remote-support tool.

Investigators could not determine how hackers entered XTIUM's system, so the account does not establish the precise route of access. Connecticut Attorney General William Tong said the organizations had a duty to protect the records and failed to meet it. Patch attributes that statement to Tong, who announced the penalties.

The state attorneys general said hackers stole the records; the reporting does not present a competing account of who accessed the systems or the scale of the affected populations. The settlement sets out financial penalties and stronger data protections. The detailed breakdown reported by FingerLakes1 assigns $2.1 million to New York and $540,000 to Connecticut.

Patch describes the arrangement as penalties for failing to protect private information, while FingerLakes1 says the agreement requires both organizations to improve their safeguards. The Hoodline and MLex headlines also report the settlement and identify both states, but provide no further details.

The immediate stakes are the exposed personal and health-related records of residents in the two states, as well as information belonging to XTIUM employees. The reporting identifies weaknesses in the unencrypted archive and the vendor's remote-support controls, but says investigators were unable to establish how hackers entered the system.

The settlement's stated measures focus on strengthening data protections; the coverage does not detail a separate timetable for implementing them.

Why it matters

  • About 825,000 New Yorkers and 62,871 Connecticut residents had records exposed, including Social Security numbers and medical and financial information.
  • Investigators said an archive containing more than 1 million patient billing records was unencrypted and largely unprotected; the settlement requires stronger data protections.
  • The reported penalties assign $2.1 million to New York and $540,000 to Connecticut, while Patch and two headlines round the combined amount to $2.7 million.
  • Investigators also found personal data belonging to 200 XTIUM employees in New York was at risk.

What to watch next

  • Whether Boston Children's Health Physicians and XTIUM implement the stronger data protections required by the settlement.
  • Whether the organizations pay the $2.1 million to New York and $540,000 to Connecticut reported by FingerLakes1.
  • Whether investigators establish how hackers entered XTIUM's system; FingerLakes1 reports that they could not determine the entry route.
  • Whether further findings clarify the exposure of the 200 XTIUM employees' personal data in New York.

How it's being covered

Coverage analysisShow details
4 source articles · 4 unique outlets
Coverage mix: Center Only· 4 Center
Where the outlets are based: US/Canada 50% · Unknown 50%
Coverage mix
Center Only
Left
Center
Right
0 outlets
4 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once.
Geography
Where the outlets covering this story are based.
4 unique outletsDominant coverage: US/Canada
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (4 of 4 rated sources); comparatively few Left or Right-rated outlets have published on the event.
How we measure coverage

How outlets' accounts compare

2 framing differences · 2 uncorroborated claims · 3 information gaps
Sources broadly agree on the core facts but frame the story differently.Compared across 2 reports whose full text Updat3 used; 2 other outlets were checked by headline only.
Framing / emphasis differences
Sources agree on the facts but emphasise different angles, actors or consequences.
  • Patch emphasizes the Connecticut residents whose sensitive records were stolen and describes the penalties as addressing a failure to protect private information; FingerLakes1 gives the state-by-state payment breakdown and details investigators' findings about security practices.
  • The attorneys general attribute the access and theft of records to hackers; no source gives a competing account of responsibility.
Updat3: The underlying facts agree; only the emphasis differs.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • FingerLakes1 reports $2.64 million in total penalties, broken down as $2.1 million for New York and $540,000 for Connecticut. Patch and the Hoodline and MLex headlines give a rounded total of $2.7 million.
  • Connecticut Attorney General William Tong said the organizations had an obligation to protect the records and failed to do so, according to Patch.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The sources do not describe whether affected patients or employees received support or identity-protection services.
  • The sources do not give a timetable for implementing the settlement's required data protections.
  • FingerLakes1 says investigators could not determine how hackers entered XTIUM's system.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. The U.S. Department of Health and Human Services’ HIPAA Security Rule, finalized in 2003, set requirements for protecting electronic health information.
    Background · from our historical context
  2. In June 2023, hackers accessed systems operated by XTIUM, a managed-services provider, and client networks that included Boston Children’s Health Physicians.
    Background · from our historical context

How we got here

In June 2023, hackers accessed systems operated by XTIUM, a managed-services provider, and client networks that included Boston Children’s Health Physicians.

Investigators later said the incident involved an archive of more than one million patient billing records and found that XTIUM lacked adequate safeguards and monitoring for its remote-support tool; they could not determine how the hackers first entered the system.

Original sources

2 of 4 articles · US/Canada · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.