A pediatric health network based in Valhalla will pay $2.7 million to New York and Connecticut after regulators found it and its IT vendor failed to protect the medical records of hundreds of thousands of patients, including children, from a 2024 cyberattack. Boston Children's Health Physicians and its technology provider, Xtium, reached the settlement with New York Attorney General Letitia James and Connecticut Attorney General William Tong on Friday.
According to a statement posted by NY AG James
, her office and Attorney General Tong secured the payout after the healthcare network and its IT company “failed to protect patients' medical information.” Under the terms announced by the
New York State Office of the Attorney General
, Boston Children's Health Physicians and Xtium will pay a $2.1 million penalty to New York and $540,000 to Connecticut.
The settlement also comes with teeth attached to future behavior. The same enforcement agreement requires the healthcare network to pay an additional $1.04 million to New York and $260,000 to Connecticut in suspended penalties if it fails to comply with mandated cybersecurity reforms going forward, according to the New York State Office of the Attorney General.
Nearly 888,000 Patients Across Two States Affected
The scale of the breach is what drew a joint investigation from two state attorneys general in the first place. Investigators determined the 2024 incident compromised the personal information of approximately 825,000 New York residents and 62,871 Connecticut residents, per the Connecticut Office of the Attorney General.
Boston Children's Health Physicians is a multi-specialty pediatric group affiliated with Boston Children's Hospital, employing more than 300 clinicians across 60 practice locations in New York and Connecticut, with a presence in the Hudson Valley and Connecticut, according to BankInfoSecurity. State regulators faulted the network for knowing its vendor's security controls were inadequate without taking corrective action, the same investigation found.
Vendor's Security Gaps Left Breach Origins a Mystery
What state investigators uncovered about Xtium's systems paints a troubling picture of basic security failures. The company failed to enforce standard IT security controls, lacked adequate logging to detect misuse of remote support tools, and maintained systems so deficient it could not even confirm how hackers initially breached its network, the Connecticut Office of the Attorney General's investigation found.
The intrusion traces back to the BianLian cybercrime group, which gained unauthorized entry into the IT vendor, then known as ATSG, on September 6, 2024, and subsequently accessed Boston Children's Health Physicians' network four days later, on September 10, 2024, according to a timeline reported by The HIPAA Journal. The network's electronic medical records system remained isolated and unaffected, even as administrative files were exfiltrated. ATSG renamed itself Xtium, Inc. in March 2025.
Ransomware Group Shifted From Encryption to Pure Data Theft
The tactics used against Boston Children's Health Physicians reflect a broader shift among cybercriminals targeting healthcare systems away from file-encrypting ransomware, according to Paubox. BianLian shifted away from file encryption, the same report found.
Separate $5.15 Million Settlement Already Compensating Patients
The state penalties are distinct from an earlier private legal resolution that directly paid affected individuals. In August 2025, Boston Children's Health Physicians and the vendor then known as ATSG Inc. agreed to a separate $5.15 million class action settlement resolving consolidated lawsuits in Westchester County Supreme Court, stemming from *Noni Wahab et al. v. Boston Children's Health Physicians*, which alleged negligence and breach of contract tied to the 2024 incident.
That settlement received final judicial approval in December 2025 and began disbursing payments to affected patients and employees on April 29, 2026, offering up to $5,000 for documented out-of-pocket losses alongside two years of medical identity monitoring, according to the Noni Wahab et al. v. Boston Children's Health Physicians Settlement Website. Claimants could choose documented financial loss reimbursements or opt for smaller flat cash payouts without proof of loss.
Together, the two resolutions total close to $8 million in combined penalties and compensation stemming from a single vendor-driven breach. Per NY AG James's statement, her office and Attorney General Tong's are now focused on ensuring Boston Children's Health Physicians and Xtium implement new measures to protect patients' data going forward.
