Published
October 20, 2026
Boston Children’s Health Physicians and its former IT vendor XTIUM agreed to pay $2.7 million to New York and Connecticut and to overhaul their data security, the two states’ attorneys general announced on October 16, 2026. The settlement resolves state investigations of a 2024 breach; the money is a penalty paid to the states, and there is no claim process for patients or families.
Allegations Only · No Settlement Yet
This article describes a settlement between two state attorneys general and two companies. Boston Children’s Health Physicians and XTIUM neither admitted nor denied the New York attorney general’s findings, and no court has ruled on them. The money goes to the states, and there is nothing for consumers to claim. This page is informational and is not legal advice.
What Did New York and Connecticut Announce?
New York Attorney General Letitia James and Connecticut Attorney General William Tong announced on October 16, 2026 that Boston Children’s Health Physicians, LLP and XTIUM had agreed to settle their offices’ joint investigation of a 2024 data breach. New York’s settlement is an Assurance of Discontinuance, No. 2026-057, signed by both companies on October 15 and by the New York attorney general’s office on October 16. A footnote in that document says Connecticut entered into a similar agreement with the companies.BCHP is a pediatric medical practice based in Valhalla, New York. According to the New York assurance, its doctors practice at more than 60 locations in New York and five in Connecticut, and its network includes more than 300 physicians. XTIUM is an IT management company. The assurance says BCHP’s vendor at the time, Axispoint Technology Solutions Group, Inc., later merged with Evolve IP to form XTIUM, and that the vendor was contractually responsible for managing, but not securing, the BCHP systems that were breached.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Status
Settled October 16, 2026
NY Assurance No. 2026-057 · similar Connecticut agreement
Payment
$2.7M Now · $1.3M Suspended
penalties and costs paid to the two states
Can I Claim?
No — nothing to claim
state settlement, not a class action fund
What Happened in the 2024 Breach?
The account below comes from the New York attorney general’s findings in the assurance. According to those findings, a threat actor got into XTIUM’s systems in August 2024 and from there reached 18 of XTIUM’s client systems, but BCHP was the only one of those clients to suffer a data breach. XTIUM told BCHP about its own breach on September 6, 2024. BCHP reset user passwords the next day, detected unauthorized activity on September 10, cut its network off from the internet while it investigated and brought its systems back online by September 13.A third-party investigation found that the attackers had taken an unencrypted archive of patient billing records containing patient and guarantor names, addresses, dates of birth, Social Security information, health insurance information, billing information and treatment information. BCHP employee records with names, addresses, dates of birth, Social Security numbers and driver’s license numbers were also taken. New York says the records of about 825,000 New Yorkers were exfiltrated and that more than 170,000 of them included Social Security or driver’s license numbers. Connecticut’s announcement puts the number of affected Connecticut residents at 62,871.
XTIUM’s own systems were breached as well. The assurance says about 1,000 XTIUM employee records were taken, including those of more than 200 New Yorkers; Connecticut’s announcement says 16 were Connecticut residents.
What the Attorneys General Found
New York found that XTIUM set up a third-party remote support tool, which the attackers used to get in, without all of the security measures the tool’s maker recommended, and that its logging and monitoring were weak enough that it still cannot say for certain how the attackers got into its system. The assurance also says XTIUM managed parts of BCHP’s system through a single shared administrative account with unrestricted access.As for BCHP, the findings say the attackers used that XTIUM account and then took over four unrestricted BCHP service accounts to reach the practice’s entire system. New York found that BCHP lacked common security controls such as account restrictions, network segmentation, least-privilege access and vendor assessments; that a 2023 third-party security audit had flagged missing security policies, missing tools, the lack of an incident response plan and confusion over which security services XTIUM was providing; and that BCHP did not reasonably respond to that audit. The assurance also says several BCHP executives responsible for data security knew for more than two years before the breach that BCHP was hosting an unencrypted archive of more than a million patient payment records.
New York concluded that both companies violated New York Executive Law § 63(12), the state’s data security law (General Business Law § 899-bb) and the HIPAA Security Rule. BCHP and XTIUM neither admit nor deny those findings, according to the assurance.
What the Companies Agreed To
Under the New York assurance, BCHP and XTIUM owe a total of $4 million in penalties and costs to the two states. An initial $2.7 million from both companies is due within 30 days of the October 16 effective date and is split between the two attorneys general as they designate; the document does not say how much of it each company pays. The other $1.3 million is suspended and would come due from BCHP alone if New York finds that BCHP materially breached the agreement within 10 years.Both offices’ announcements describe the initial payment as a $2.1 million penalty to New York and $540,000 to Connecticut, and the suspended amount as $1,040,000 for New York and $260,000 for Connecticut. The initial figures add up to $2.64 million; neither announcement itemizes the remaining $60,000 of the $2.7 million that the assurance describes as penalties and costs.
Each company must also keep a written information security program built on zero-trust principles and name a qualified chief information security officer who reports to its leadership. Within set deadlines, each must tighten account access controls, build an inventory of the private information it holds, keep logging and monitoring that alerts on suspicious activity, and strengthen its incident response. Each company must get an independent security assessment within 180 days and then once a year for three years, and BCHP must certify its compliance to New York every year.
Where the $2.7 Million Goes
The money is paid to the New York and Connecticut attorneys general as penalties and costs. Neither the assurance nor either office’s announcement describes restitution to patients, a claim form or any other payment to individuals, and the assurance says it is not intended for use by any third party in any other proceeding.The Earlier $5.15 Million Class Action Settlement
Patients and employees affected by the same breach had a separate route to compensation through a private class action, Noni Wahab, et al. v. Boston Children’s Health Physicians, LLP, et al., Case No. 73692/2024, in the Supreme Court of New York, Westchester County. The defendants were BCHP and ATSG, Inc., which the class notice describes as the managed services provider that supplied IT services to BCHP. The plaintiffs alleged the September 2024 incident may have exposed information of about 918,000 BCHP patients and employees. The defendants denied any wrongdoing and agreed to a $5,150,000 settlement fund.The class included everyone BCHP notified, directly or indirectly, that their information may have been affected. Class members could choose reimbursement of up to $5,000 for documented losses or a pro rata cash payment estimated at $100, plus two years of medical data monitoring. The claim deadline was November 25, 2025, and the final approval hearing was set for December 10, 2025. The official settlement website now lists a final approval order and says payments on valid claims were issued April 29, 2026, with uncashed payments set to become void on October 26, 2026.
Questions
Can I get money from the Boston Children’s Health Physicians attorney general settlement?
No. The $2.7 million is a penalty and costs payment to the New York and Connecticut attorneys general. Neither the settlement nor the states’ announcements describe any payment to patients or a claim process.
How much are BCHP and XTIUM paying New York and Connecticut?
The New York assurance sets $4 million in penalties and costs: $2.7 million due now from both companies, and $1.3 million suspended that BCHP would owe only if New York finds a material breach of the agreement within 10 years. The states’ announcements describe the initial payment as $2.1 million to New York and $540,000 to Connecticut.
How many people were affected by the BCHP data breach?
New York says the records of about 825,000 New Yorkers were taken, more than 170,000 of them with Social Security or driver’s license numbers. Connecticut says 62,871 of its residents were affected. The plaintiffs in the separate class action alleged about 918,000 patients and employees.
Did Boston Children’s Health Physicians admit wrongdoing?
No. Under the New York assurance, BCHP and XTIUM neither admit nor deny the attorney general’s findings. In the separate Wahab class action, the defendants denied any wrongdoing.
Is the Wahab v. Boston Children’s Health Physicians settlement still open?
No. The claim deadline in the $5.15 million class settlement was November 25, 2025. The official settlement website says payments on valid claims were issued April 29, 2026 and that uncashed payments become void on October 26, 2026.
Sources
• New York Attorney General press release (October 16, 2026) and Assurance of Discontinuance No. 2026-057, In the Matter of Boston Children’s Health Physicians, LLP and XTIUM• Connecticut Attorney General press release (October 16, 2026)
• Official Wahab v. Boston Children’s Health Physicians settlement website and long form notice, Supreme Court of New York, Westchester County, Case No. 73692/2024
For more class actions keep scrolling below.
Status
Settled October 16, 2026
Matter
In the Matter of Boston Children’s Health Physicians, LLP and XTIUM
Settlement Number
New York Assurance of Discontinuance No. 2026-057
Agencies
New York and Connecticut Attorneys General
Payment
$2.7 million to the states, plus $1.3 million suspended
Official Website
New York Attorney General Announcement
