Connecticut will receive a $540,000 penalty under a settlement with Boston Children’s Health Physicians and its technology vendor, XTIUM, Attorney General William Tong’s office announced October 16.
The agreement concerns an August 2024 vendor breach—not a newly announced 2026 intrusion. The attorney general said stolen BCHP records affected 62,871 Connecticut residents and included Social Security numbers and medical information.
Tong’s office said the investigation identified security deficiencies, including an unencrypted billing archive and issues flagged in a 2023 audit. XTIUM could not confirm how the attackers initially entered its systems, according to the release.
The settlement requires information-security improvements, including data inventories, stronger authentication, log monitoring and incident-response measures, the announcement says.
BCHP would owe Connecticut an additional $260,000 only if it violates the agreement. That conditional amount is not part of the presently announced $540,000 state penalty.
The announcement describes regulatory penalties and security requirements; it does not establish an individual compensation payment or a new consumer claim deadline. The signed settlement was not independently reviewed.