CT & NY Secure $2.7M Data Breach Settlement

Connecticut and New York have successfully secured a massive $2.7 million multi-state data breach settlement following a major cyber security failure. The legal action targeted Boston Children’s Health Physicians and IT management company XTIUM over a severe 2024 incident.

As state residents navigate the fallout of compromised personal data, local officials emphasize the importance of robust digital protection. Understanding about Connecticut security regulations helps residents stay informed on how authorities protect consumer privacy across our region.

Find Your Ideal Getaway in Connecticut
Explore top-rated stays with no booking fees and instant confirmation. Your dream trip starts here!
Start Exploring Now

The Anatomy of the 2024 XTIUM and BCHP Data Breach

The sweeping investigation stems from an August 2024 cyber attack originating at XTIUM that ultimately compromised 18 different client networks. Among the impacted entities was Boston Children’s Health Physicians, leaving hundreds of thousands of individuals vulnerable.

Hackers managed to steal sensitive personal records belonging to roughly 825,000 New York residents and over 62,000 individuals living in Connecticut. The compromised files contained highly sensitive information, including Social Security numbers and official driver’s license data.

Severe Security Lapses and Audit Failures Uncovered

State investigators uncovered alarming security oversights, revealing that BCHP completely failed to implement standard cybersecurity policies. Furthermore, organization executives knowingly ignored critical vulnerabilities that were explicitly identified during a formal 2023 security audit.

To make matters worse, leadership allowed an unencrypted archive containing over one million patient billing records to remain completely unprotected for two full years. Meanwhile, IT vendor XTIUM lacked basic data safeguards, proper activity logging, and effective monitoring tools required to track remote support misuse.

Settlement Terms and Enhanced Compliance Mandates

Under the terms of the official resolution, the responsible companies are required to pay substantial financial penalties to both states. New York will receive $2.1 million, while Connecticut is set to collect $540,000 alongside suspended penalties if compliance terms are violated.

Both firms are now legally mandated to adopt comprehensive information security programs, detailed data inventories, and enhanced threat-response procedures. This landmark case highlights the strict enforcement consequences that healthcare networks and supply chain vendors face for critical security deficiencies.

Here is the source article for this story: New York and Connecticut settle $2.7m data breach case

Discover Your Perfect Stay in Connecticut
Find available hotels and vacation homes instantly. No fees, best rates guaranteed!
Check Availability Now