Boston Children's Health Physicians Data Breach
The 2024 Boston Children's Health Physicians data breach followed a security incident at IT services provider ATSG and resulted in unauthorized access to the BCHP network and the exfiltration of files.
Exposed Data Types
3 sensitive9- Medical record numbers
- Medical information
- Health insurance information
- Names
- Physical addresses
- Dates of birth
- Social security numbers
- Driver's licenses
- Billing information
About This Breach
BCHP said its vendor reported unusual activity on September 6, 2024 and that it identified unauthorized activity in its own network on September 10.
Boston Children's Health Physicians is a multi-specialty group providing pediatric primary and specialty care in New York and Connecticut. ATSG later became XTIUM.
When did the breach occur?
According to BCHP's timeline, the IT provider reported unusual activity in its systems on September 6, 2024. On September 10, an unauthorized party used the provider's access to enter limited parts of the BCHP network and exfiltrate files. Individual notifications began around October 4, 2024.
What information may have been affected?
Depending on the individual, the files may have included names, Social Security numbers, addresses, dates of birth, driver's-license numbers, medical-record numbers, health-insurance information, billing information and limited treatment information. Not every category applied to every person. BCHP said its electronic medical-record system was not affected.
How many people were affected?
ATSG's report to the U.S. Department of Health and Human Services lists protected health information for 909,469 patients. Lawsuit and settlement reporting describes approximately 918,000 people when employee data is also included; this catalog entry uses the regulator-reported patient count.
What did the organization do?
BCHP said it shut down systems as a protective measure, conducted a digital-forensics investigation and strengthened monitoring and security safeguards. It offered complimentary credit monitoring to people whose Social Security or driver's-license numbers were involved.
What should affected people do?
Notice recipients should review credit reports, health-insurance explanations and medical bills for unfamiliar activity. People whose Social Security or driver's-license information was involved may also wish to consider a credit freeze or fraud alert.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
