A pediatric health network and the IT company that managed its systems will pay a combined $2.7 million after hackers broke into 18 client networks in August 2024, stealing Social Security numbers and medical records belonging to tens of thousands of patients across two states. Connecticut Attorney General William Tong and New York Attorney General Letitia James announced the settlements this week, closing out one of the larger healthcare data breach enforcement actions of 2026 and putting a dollar figure on what regulators think patient-data negligence should cost.
The companies involved are Boston Children’s Health Physicians (BCHP), a pediatric care network, and XTIUM, the managed IT services provider that ran BCHP’s network infrastructure. According to Patch’s reporting on the settlement, nearly 63,000 Connecticut residents had their medical records and Social Security numbers exposed when attackers moved through XTIUM’s systems and into the networks of 18 separate clients, BCHP among them. New York, where BCHP’s patient base is far larger, counted roughly 825,000 affected individuals.
What Happened in the BCHP and XTIUM Data Breach
The breach traces back to August 2024, when hackers gained access to XTIUM’s managed IT environment. XTIUM served as the outsourced technology backbone for at least 18 client networks, and BCHP’s pediatric care network was one of them. Once inside, the attackers did not stay confined to a single client. They moved laterally across the shared infrastructure, a pattern that has become familiar in managed-service-provider breaches where one vendor compromise cascades into dozens of downstream victims.
Both Attorney General Tong’s office and Attorney General James’s office opened investigations following the intrusion, according to the joint settlement announcement posted on Connecticut’s state government site. The resulting consent orders, finalized this month, cover both BCHP’s handling of patient records and XTIUM’s security practices as the managed provider responsible for protecting them.
How Many Patients Were Affected in Connecticut and New York
The scale gap between the two states is striking. Connecticut’s Office of the Attorney General put the number of affected residents at 62,871, a figure confirmed in Patch’s coverage of the settlement. New York, where BCHP operates a much larger share of its pediatric practice network, saw approximately 825,000 individuals affected, according to Newsday’s reporting on the joint action. Combined, the two states account for nearly 888,000 people whose personal and medical information was exposed in a single incident.
That disparity is not unusual for breaches tied to regional health networks that operate across state lines. A pediatric practice group headquartered in one state can still hold records for patients spread across a much wider service area, and BCHP’s New York footprint dwarfed its Connecticut one. It also explains why the two settlements landed at such different dollar amounts, even though both stem from the same underlying intrusion.
What Information Was Exposed: SSNs, Medical Records and Billing Data
The exposed data went well beyond names and addresses. Attorneys general in both states confirmed that Social Security numbers and medical information were stolen, including dates of birth, medical-treatment details, and financial or billing records. For a pediatric network, that combination is especially sensitive. It covers children’s health histories alongside the kind of identity data that is most valuable to fraudsters, a pairing that has driven up the cost of healthcare breach remediation across the industry for years.
Unlike breaches limited to login credentials or payment card numbers, Social Security numbers tied to medical billing records carry a longer fraud tail. Victims cannot simply cancel a Social Security number the way they would a stolen credit card. For families whose children’s information was included, that risk window extends for years, which is part of why both attorneys general pushed for monitoring and notification commitments as part of the settlements rather than relying on BCHP and XTIUM’s existing breach response alone.
The Unencrypted Archive: More Than 1 Million Billing Records
One detail stands out in the investigation findings cited by Patch: BCHP was separately found to be hosting an unencrypted archive containing more than 1 million patient billing records. That archive is distinct from the 62,871 Connecticut residents and roughly 825,000 New York individuals confirmed as affected by the breach itself. It represents a broader storage practice that regulators flagged as part of the same enforcement action, pointing to a gap between how many records were technically breached and how many were sitting exposed to begin with.
Unencrypted storage of this volume is the kind of finding that tends to shape settlement terms as much as the breach itself. Regulators increasingly treat the existence of unprotected, high-volume archives as an independent violation, separate from whether an attacker actually reached that specific dataset. It is a pattern worth watching for any organization that still keeps billing or claims data in plaintext for operational convenience.
Connecticut’s $540,000 Settlement Explained
Connecticut’s portion of the settlement totals $540,000, split between BCHP and XTIUM under terms negotiated with Attorney General Tong’s office. Tong, who has built a track record of pursuing healthcare and consumer data cases, framed the case in blunt terms. “BCHP collected deeply sensitive information from their pediatric patients and their families. They had an obligation to safeguard those records, and they failed,” Tong said, according to Patch’s report on the settlement.
That statement matters beyond this single case. Connecticut has been active on data-breach enforcement this year, and this is not Tong’s only recent settlement involving an IT or telecom vendor’s security failures. His office also closed a $625,000 settlement with Frontier Communications over a separate data breach, according to MLex’s coverage of that case. Measured side by side, the BCHP/XTIUM penalty sits close to that earlier Frontier figure, suggesting Connecticut regulators are settling into a rough band for breach-related consumer harm when Social Security numbers are involved.
New York’s $2.1 Million Settlement Explained
New York’s share of the joint action is $2.1 million, roughly four times Connecticut’s portion, in proportion with the far larger number of affected New York residents. Attorney General Letitia James’s office has pursued an aggressive health-data enforcement agenda over the past two years, and this settlement continues that pattern. The Newsday report on the joint settlement frames the $2.1 million figure as reflecting both the scale of New York’s affected population and the severity of the data categories exposed, namely Social Security numbers combined with medical treatment histories.
Combined, the $540,000 Connecticut penalty and the $2.1 million New York penalty add up to the $2.7 million total settlement figure reported by both states, a detail confirmed in Forth’s summary of the two-state action. That combined number is likely to be the headline figure most coverage settles on, but the state-by-state breakdown tells the more useful story about how regulators are pricing breach harm relative to population size.
Connecticut vs. New York: Settlement Terms Side by Side
| Metric | Connecticut | New York |
|---|---|---|
| Attorney General | William Tong | Letitia James |
| Residents affected | 62,871 | Approximately 825,000 |
| Settlement amount | $540,000 | $2.1 million |
| Approx. settlement per resident | ~$8.59 | ~$2.55 |
| Combined total (both states) | $2.7 million | |
The per-resident figures above are a simple calculation from the public settlement totals and affected-resident counts, not numbers published by either attorney general’s office. They illustrate that Connecticut’s smaller, more concentrated group of victims drew a proportionally higher per-person penalty than New York’s larger population did, even though New York’s total dollar figure is nearly four times bigger.
Why XTIUM’s Breach Hit 18 Client Networks, Not Just One
The detail that the intrusion reached 18 client networks serviced by XTIUM, not just BCHP’s, is the part of this story that security teams outside healthcare should pay closest attention to. XTIUM was not the end target. It was the shared infrastructure layer sitting underneath a group of unrelated organizations, and a single compromise there fanned out to every client whose network depended on it. BCHP happens to be the client whose exposure drew the two attorneys general’s attention, largely because of the volume and sensitivity of the pediatric medical records involved, but the structural weakness was at the managed-service layer.
This is the same dynamic that has driven some of the largest breach notifications of the past several years: one vendor, many downstream victims, and a blast radius that is hard for any single client organization to control because the vulnerable systems were never theirs to patch in the first place.
The Third-Party Risk Problem: When Your Vendor Is the Breach
Healthcare organizations have leaned harder on managed IT and cloud vendors every year, largely because running security operations in-house is expensive and talent is scarce. That tradeoff shows up clearly in this case. BCHP, as a pediatric practice group, almost certainly did not build or operate the infrastructure that was breached. XTIUM did. Yet BCHP is named alongside XTIUM in both settlements, and BCHP’s own unencrypted billing archive became a separate point of liability regardless of who managed the network it sat on.
That is the regulatory signal worth internalizing here: outsourcing IT operations does not outsource legal responsibility for the data. Both the vendor and the client that handed over the data can end up named in the same enforcement action, and a vendor’s security failure becomes the client’s settlement bill just as surely as it becomes the vendor’s.
How This Breach Compares to Other 2026 Data Incidents
The BCHP/XTIUM case is one of several large personal-data exposure stories that shattered.io has tracked through 2026, and the comparison is useful for sizing up where it sits on the spectrum. Some incidents this year, like the breach disclosed at Holland & Knight, involved a small number of exposed individuals but high-value legal client data. Others, like the breach at Zizzl LLC, sat in the low hundreds. At the far end of the scale, Denmark’s CPR registry breach reportedly affected 8.8 million people after a weak password was implicated, and the UK Legal Aid Agency breach exposed roughly 250,000 records, some dating back decades.
BCHP and XTIUM’s combined 887,871 affected individuals across Connecticut and New York place this case well above the mid-sized breaches this year and closer to the scale of the Denmark incident, though still short of it. What sets the BCHP case apart from most of the comparisons above is that it produced an actual dollar settlement with named dollar figures this quickly. Many breach disclosures this year have not yet reached a resolved enforcement stage, which makes the $2.7 million figure here a useful benchmark for what regulators are currently willing to assess against a healthcare-adjacent vendor breach of this size.
Recent Breach Disclosures and Settlements Compared
| Incident | People/Records Affected | Data Exposed | Status |
|---|---|---|---|
| BCHP / XTIUM (CT + NY) | ~887,871 combined | SSNs, medical records, billing data | $2.7M settlement reached |
| Frontier Communications (CT) | Not specified in settlement | Personal/account data | $625,000 CT settlement |
| Denmark CPR registry | 8.8 million | National ID numbers | Breach disclosed |
| UK Legal Aid Agency | ~250,000 | Records tracing to 1978 | Breach disclosed |
| Holland & Knight | 14 clients | SSNs | Breach disclosed |
| Zizzl LLC | 519 people | SSNs | Breach disclosed |
Figures for incidents other than BCHP/XTIUM and the Frontier settlement reflect numbers previously reported in shattered.io’s own coverage of those stories, linked throughout this article, rather than new reporting in this piece.
What Attorneys General Are Signaling About Health Data Enforcement
Tong and James did not just settle a case. They jointly announced it, which is itself a signal. Multi-state coordination on healthcare breach enforcement has become more common as attorneys general compare notes on vendors whose managed infrastructure touches clients in several states at once. XTIUM’s 18-client footprint meant both offices were almost certainly going to end up investigating the same underlying intrusion regardless of coordination, so a joint announcement lets both states claim credit for the outcome while presenting a unified set of findings to the public.
For other managed-service providers watching this case, the message is that a single incident touching multiple states no longer means multiple, uncoordinated investigations with inconsistent outcomes. It increasingly means a joint settlement with a combined headline number, the kind of number that is far more likely to make national news than two separate smaller settlements would. The pattern echoes other 2026 cases where a slow notification process became its own story, such as the 81-day notice gap in the EY data breach, or where the exposed party was a technology platform rather than a healthcare provider, as with the Meta GitHub breach affecting 1,500 people.
What Affected Patients Should Do Now
Anyone notified that their information was part of the BCHP or XTIUM breach should treat the exposure of a Social Security number as the primary risk, not the medical details, which carry less direct financial fraud risk. That means placing a credit freeze with the three major credit bureaus, watching for notices from BCHP or XTIUM about any credit monitoring services offered as part of the settlement terms, and checking bank and credit statements for unfamiliar activity over the coming months rather than assuming the risk window is short.
For a pediatric population specifically, parents should also watch for signs of identity misuse tied to their children’s Social Security numbers, which can go undetected for years since minors rarely have credit activity that would otherwise flag fraud early. Filing a credit freeze for a minor is a separate process from an adult’s freeze in most states, and it is worth doing regardless of whether any fraud has appeared yet.
Predictions: Where Healthcare Breach Enforcement Goes Next
- More joint, multi-state settlements: expect attorneys general to keep coordinating on cases involving managed-service providers whose client lists span state lines, since it produces bigger combined headline numbers and shared investigative costs.
- Scrutiny of unencrypted archives as a standalone violation: the 1-million-record unencrypted billing archive at BCHP suggests regulators will keep treating plaintext storage of sensitive data as its own enforcement issue, separate from whether that specific data was confirmed stolen.
- Rising settlement figures tied to Social Security number exposure: Connecticut’s roughly $8.59-per-resident settlement in this case, against a smaller $625,000 Frontier Communications settlement earlier this year, points toward escalating per-incident penalties when SSNs and medical data are combined.
- More scrutiny on managed IT providers specifically, not just their healthcare clients: as XTIUM’s 18-client exposure shows, a single managed-service compromise can trigger investigations across every downstream client, which raises the stakes for any vendor serving multiple regulated industries at once.
- Pediatric-specific breach notification rules gaining traction: given how long identity fraud involving a minor’s Social Security number can go unnoticed, expect state legislators to push for longer monitoring periods or mandatory minor-specific credit freeze assistance in future healthcare breach settlements.
These are analytical projections based on the pattern of this settlement and recent Connecticut enforcement activity, not confirmed statements from either attorney general’s office.
The Market Impact: What This Means for Healthcare IT Vendors
For managed service providers serving healthcare clients, this settlement adds a concrete dollar figure to the cost side of a risk calculation that has mostly been theoretical. A $2.7 million combined settlement spread across two companies, with Connecticut’s share working out to roughly $8.59 per affected resident, gives compliance and legal teams a real number to model against when deciding how much to invest in network segmentation, encryption-at-rest requirements, and vendor security audits.
It also raises the stakes for healthcare organizations evaluating which IT vendors to trust with patient data. A vendor whose breach exposes 18 client networks at once is a vendor whose own security posture now effectively becomes every client’s liability. Expect procurement and vendor-risk teams at hospital systems and physician networks to start asking harder questions about network segmentation between clients sharing the same managed infrastructure, precisely the gap that let this breach spread across BCHP and 17 other organizations.
Frequently Asked Questions
What companies were involved in the BCHP and XTIUM data breach?
Boston Children’s Health Physicians (BCHP), a pediatric care network, and XTIUM, the managed IT services provider that ran BCHP’s network infrastructure. XTIUM’s systems served 18 client networks in total, and the breach reached all of them.
When did the BCHP/XTIUM breach happen?
The breach occurred in August 2024. The settlements with Connecticut and New York were announced this month, in October 2026.
How many people were affected by the breach?
Connecticut confirmed 62,871 affected residents. New York confirmed approximately 825,000 affected individuals, bringing the combined total to roughly 887,871 people across both states.
What information was stolen in the breach?
Social Security numbers and medical information, including names, addresses, dates of birth, medical-treatment details, and financial or billing records. Separately, BCHP was found to be hosting an unencrypted archive of more than 1 million patient billing records.
How much are BCHP and XTIUM paying in settlements?
Connecticut’s settlement totals $540,000. New York’s settlement totals $2.1 million. Combined, the two settlements add up to $2.7 million.
Who are the attorneys general behind the settlements?
Connecticut Attorney General William Tong and New York Attorney General Letitia James jointly announced the settlements following separate investigations by each office into the same underlying breach.
What should affected patients do?
Affected individuals should consider placing a credit freeze with the major credit bureaus, watch for any credit monitoring offer tied to the settlement, and monitor financial accounts for unfamiliar activity. Parents of affected minors should pay particular attention, since fraud tied to a child’s Social Security number can go undetected for years.
Is this the only data breach settlement Connecticut has reached this year?
No. Connecticut Attorney General William Tong’s office also reached a separate $625,000 settlement with Frontier Communications over a different data breach, according to MLex’s reporting, indicating an active enforcement pace on data-breach cases in the state this year.