ReportedUpdated 3 Nov 2026
2024 hacking incident at Boston Children's Health Physicians
What happened
A pediatric practice in New York and Connecticut and one of its former IT services vendors will collectively pay those two states financial penalties of $2.7 million for a 2024 hacking incident that affected nearly 900,000 people.
Reported impact
An affected population has not been established in the accepted evidence.
Reported data types
namesaddressespayment cardshealth data
- Attack method
- hacking incident
- Attributed actor
- BianLian
Source evidence
1Read the original reporting and statements. Multiple articles may rely on the same underlying source.
The attorneys general of New York and Connecticut have fined Boston Children's Health Practice and its former third-party IT services vendor XTIUM $2.7 million - and possibly up to $4 million - for a 2024 hack.
Attributed reporting
4 more excerpts
Threat actors in August 2024 hacked into Xtium's network, initially infiltrating into 18 of the company's client systems.
Attributed reporting
Hackers stole the records of approximately 825,000 New Yorkers and 62,871 Connecticut residents from BCHP’s network, including Social Security numbers and medical information.
Attributed reporting
Investigators determined that BCHP executives had known for more than two years about an unencrypted archive containing over 1 million patient payment records, including names, addresses, dates of birth, Social Security numbers, medical and treatment information, and other billing information.
Attributed reporting
Ransomware gang BianLian claimed responsibility for the attack
Attributed reporting
Updates and corrections
- Revision 1
Incident updated.