Boston Children's Health Physicians and XTIUM settle with NY and CT AGs over 2024 MSP breach exposing ~890,000 patients
Boston Children's Health Physicians (BCHP) and its managed IT provider XTIUM (formerly Axispoint Technology Solutions Group) settled with the New York and Connecticut Attorneys General over an August 2024 breach affecting almost 890,000 individuals. The settlement carries a $4 million penalty, of which $2.7 million is payable (New York $2.1 million, Connecticut $540,000) and $1.3 million is suspended pending compliance. A threat actor, not named in the article, compromised XTIUM and 18 of its clients, then exfiltrated an unencrypted BCHP billing database containing sensitive personal and health information. Regulators found violations of the HIPAA Security Rule and New York Executive Law, citing weak access controls, poor logging, and known but unaddressed audit findings.
Detalhes técnicos
- The attacker exploited a remote access tool used by XTIUM and compromised the systems of XTIUM and 18 clients, including BCHP.
- Not all recommended security settings for the tool were implemented, and logging and monitoring were lacking. The exact intrusion method could not be determined.
- BCHP used a single shared administrative account with unrestricted privileges. The attackers compromised four further unrestricted admin accounts and gained access to BCHP's entire system.
- Other deficiencies: insufficient network segmentation, no least privilege, weak privileged account management, governance and vendor assessments.
- A 2023 third-party audit flagged issues that were not remediated. Executives had known for two years that an archive of over 1 million billing records was unencrypted, and it was exfiltrated.
- Exposed data: patient and guarantor names, contact details, dates of birth, SSNs, driver's license numbers, health insurance, treatment and billing information. About 825,000 New York and 62,871 Connecticut residents were affected, including SSNs and/or driver's licenses of about 170,000 New Yorkers. About 1,000 XTIUM employee records were also compromised.
- Timeline: XTIUM notified BCHP on Sept 6, 2024. BCHP reset only user passwords on Sept 7, not system or admin passwords, and did not isolate from the internet. It found unauthorized activity on Sept 10 and isolated its systems. Systems were restored Sept 13, 2024.
Remediação
The settlement requires both entities to maintain an accurate inventory of private information and protect it, implement reasonable authentication for access to private information, deploy logging and monitoring, and strengthen threat response procedures.
Linha do tempo
-
Boston Children's Health Physicians and XTIUM settle with NY and CT AGs over 2024 MSP breach exposing ~890,000 patients
ler a análise desta fonte ocultar
Boston Children's Health Physicians (BCHP) and its managed IT provider XTIUM (formerly Axispoint Technology Solutions Group) settled with the New York and Connecticut Attorneys General over an August 2024 breach affecting almost 890,000 individuals. The settlement carries a $4 million penalty, of which $2.7 million is payable (New York $2.1 million, Connecticut $540,000) and $1.3 million is suspended pending compliance. A threat actor, not named in the article, compromised XTIUM and 18 of its clients, then exfiltrated an unencrypted BCHP billing database containing sensitive personal and health information. Regulators found violations of the HIPAA Security Rule and New York Executive Law, citing weak access controls, poor logging, and known but unaddressed audit findings.
Technical Details
- The attacker exploited a remote access tool used by XTIUM and compromised the systems of XTIUM and 18 clients, including BCHP.
- Not all recommended security settings for the tool were implemented, and logging and monitoring were lacking. The exact intrusion method could not be determined.
- BCHP used a single shared administrative account with unrestricted privileges. The attackers compromised four further unrestricted admin accounts and gained access to BCHP's entire system.
- Other deficiencies: insufficient network segmentation, no least privilege, weak privileged account management, governance and vendor assessments.
- A 2023 third-party audit flagged issues that were not remediated. Executives had known for two years that an archive of over 1 million billing records was unencrypted, and it was exfiltrated.
- Exposed data: patient and guarantor names, contact details, dates of birth, SSNs, driver's license numbers, health insurance, treatment and billing information. About 825,000 New York and 62,871 Connecticut residents were affected, including SSNs and/or driver's licenses of about 170,000 New Yorkers. About 1,000 XTIUM employee records were also compromised.
- Timeline: XTIUM notified BCHP on Sept 6, 2024. BCHP reset only user passwords on Sept 7, not system or admin passwords, and did not isolate from the internet. It found unauthorized activity on Sept 10 and isolated its systems. Systems were restored Sept 13, 2024.
Remediation
The settlement requires both entities to maintain an accurate inventory of private information and protect it, implement reasonable authentication for access to private information, deploy logging and monitoring, and strengthen threat response procedures.