Pediatric Practice and IT Vendor Fined $2.7M Over BianLian Ransomware Attack

Boston Children's Health Physicians (BCHP) and its former IT services vendor, Xtium, have agreed to pay a combined $2.7 million in penalties to New York and Connecticut. This settlement resolves investigations into a significant 2024 ransomware attack that compromised the data of nearly 900,000 individuals.

The incident, claimed by the BianLian ransomware gang, originated when threat actors infiltrated Xtium's network in August 2024. While 18 of Xtium's clients were initially affected, investigators determined that only BCHP suffered a data breach due to alleged security practice weaknesses within the vendor's systems. The stolen data included sensitive personal and medical information, as well as Social Security numbers, affecting approximately 825,000 New Yorkers and 62,871 Connecticut residents, along with around 4,000 BCHP employees.

Investigators identified a series of security failures on the part of both BCHP and Xtium. Connecticut officials noted that Xtium lacked sufficient logging and monitoring to detect system misuse and was unable to confirm the exact method of initial access. The firm also allegedly failed to adopt reasonable safeguards and enforce common IT system standards. These deficiencies were so pronounced that Xtium could not definitively state how hackers gained entry.

Boston Children's Health Physicians also faced criticism for inadequate access controls, network segmentation, monitoring, and privileged account management. Compounding these issues, investigators found that BCHP executives were aware for over two years of an unencrypted archive containing over one million patient payment records, including names, addresses, dates of birth, Social Security numbers, and medical and billing information. This archive remained largely unprotected until it was compromised in the 2024 breach.

The settlement includes an initial payment of $2.1 million to New York and $540,000 to Connecticut. Furthermore, BCHP and Xtium have pledged to implement a comprehensive list of data security program improvements. Failure to adhere to these promises within the next 10 years could trigger a secondary penalty of $1.3 million, split between the two states.

Neither BCHP nor Xtium admitted or denied the findings of the investigations as part of the agreement. BCHP has stated its commitment to strong privacy and data security practices, while Xtium has not yet responded to requests for comment. The agreements mandate strengthened security programs, the appointment of qualified security leadership, improved access controls and encryption, and regular independent security assessments for both entities.

This settlement follows a separate $5.15 million civil class-action settlement reached in August 2025 concerning the same breach. The incident highlights the critical importance of robust security measures, particularly for third-party vendors handling sensitive healthcare data, and underscores the persistent threat posed by ransomware groups like BianLian.