XTIUM warned BCHP 4 days before BCHP saw activity; NY says XTIUM cannot definitively confirm its entry route

Four days from XTIUM's warning to BCHP's detection, and an entry route nobody confirms

The New York Attorney General's Assurance of Discontinuance No. 2026-057 (the AOD), with Boston Children's Health Physicians, LLP (BCHP) and XTIUM, says that on Friday 6 September 2024 "XTIUM notified BCHP that XTIUM had suffered a system breach". On Saturday 7 September BCHP "reset all BCHP system user passwords but took no further action". On Tuesday 10 September BCHP "detected unauthorized system activity and cut off internet access to the BCHP network". That is 4 days from the warning to the detection (derived), across a weekend. The AOD took effect on 16 October 2026, 770 days after the warning (derived), the day the New York and Connecticut Attorneys General announced $2.7 million.

Two cautions go with the arithmetic. The 4 days is a gap between two dates the AOD prints, not a measure of how long anyone was inside BCHP's network: the AOD does not say when the intruders reached BCHP, and "detected" is not "began". And every fact in the AOD's findings (paragraphs 1 to 32) is one the two companies "neither admit nor deny" (paragraph 33). The AOD is the New York Attorney General's account, accepted as the basis of an undertaking. It is not a judgment.

The sentence that matters most to anyone who buys managed IT is in paragraph 18: XTIUM's "logging and monitoring of its own sign-in processes were so deficient at the time of the attack that XTIUM cannot definitively confirm how the threat actors accessed the XTIUM system". The AOD also says, in paragraph 17, that the system "was accessed by the threat actors through its implementation of a third party remote support tool". It names no tool, no vendor, no credential and no actor, and it does not say whether any data was published or sold.

This briefing is built on the 26-page AOD, read in full on Sunday 18 October 2026 from 09:58 BST (the text with pdftotext, the signature pages as images), and on the two Attorneys General's press releases of 16 October. Everything else is labelled. The HHS breach portal listing is a primary record. BCHP's own notice was read only as reported by others, because its page answers scripted requests with a bot check, which was not bypassed. HIPAA Journal, GovInfoSecurity, The Record and TechTarget are secondary. MLex showed only a paywalled summary. Connecticut's own agreement is not linked from its release and was not read. The story is developing, and a statement from either company could change the picture. None was found: XTIUM's newsroom page carries none, and BCHP's pages could not be read (a bot check on one, no connection on the other).

What was hit, and whose: stated and not stated

The AOD has two halves: findings (paragraphs 1 to 32) and relief (paragraphs 35 to 58), then boilerplate and signatures. The table sets what it states against what it leaves out. Paragraph numbers are the AOD's. Quotations are from the AOD.

What the AOD states and does not state, read in full on 18 October 2026. 26 pages, signature pages checked as images.

Question	Stated in the AOD	Not stated
Who are the parties?	BCHP: "a multi-site medical practice based in New York", doctors at "over 60 locations in New York and five in Connecticut", "over 300 doctors" (paras 1, 2). A HIPAA covered entity with two employees overseeing IT and information security at the time (paras 3, 4). XTIUM: formerly Axispoint Technology Solutions Group, Inc., which has "since merged with Evolve IP to form XTIUM"; a HIPAA business associate (paras 6, 7).	XTIUM's size or client count beyond the 18; the contract terms; the date of the merger.
What of XTIUM's was hit?	"During August 2024, a threat actor infiltrated XTIUM" and then 18 client systems (para 9). About 1,000 XTIUM employee records were exfiltrated, over 200 of them New Yorkers (para 15).	The day; which XTIUM systems; the 17 other clients, their sectors or names; what the actor did in their systems.
What of BCHP's was hit?	BCHP's "other IT systems", which XTIUM managed (para 6): an unencrypted archive of patient billing records, and employee records from a different database (paras 12, 27). The active patient records system, run by another vendor, "was not breached" (para 5).	Which server held the archive; the years it covered; why it was kept; the employee count beyond "over 4,000".
What data?	Patient and guarantor names, addresses, dates of birth, "social security information", health insurance, billing and treatment information. Employee name, address, date of birth, social security number and driver's licence number (para 12). Over 170,000 New York records with a social security or driver's licence number (para 13).	Counts by field; adults against minors; the years covered.
How many people?	"approximately 825,000 New Yorkers" (para 13) and "approximately 820,000 New Yorkers" (para 27).	Any Connecticut or other-state count (62,871 is in the releases only); what a "record" is against a person.
How was XTIUM entered?	Through "its implementation of a third party remote support tool", not implemented "utilizing all of the security measures recommended by the third party vendor" (para 17). XTIUM "cannot definitively confirm how the threat actors accessed the XTIUM system" (para 18).	The tool or its vendor; the credential or flaw; how the actors got in. The AOD does not reconcile paragraph 17 with paragraph 18.
Who did it?	"a threat actor" (para 9); "threat actors" (paras 12, 18, 23).	Any name, claim, motive or number of actors.
Was data published or sold?	The actors "accessed and exfiltrated" an unencrypted archive (para 12).	Whether anything was published, sold or used.
What did BCHP do?	Reset user passwords on 7 September; cut internet access on 10 September; back online by 13 September (paras 10, 11). "BCHP notified individuals as required by federal and state law" and offered "one year of free credit monitoring" (para 14).	The dates of BCHP's notices to people and to regulators; which accounts were reset; what BCHP knew on 7 September.
What did the two agree?	The undertakings in paragraphs 36 to 57, payment (paragraph 58) and to "neither admit nor deny" the findings (para 33).	How the $2,700,000 divides between them; the Connecticut agreement's text.

The AOD's footnote says the investigation "was conducted with the Connecticut Attorney General's office who entered into a similar agreement with Respondents". That agreement is where the Connecticut figures should sit. It is not linked from Connecticut's release, so every Connecticut number in this briefing rests on the two releases. BCHP is the entity named throughout. The AOD does not mention Boston Children's Hospital, and nothing read says that the hospital's own systems were affected. Press coverage describes BCHP as affiliated with it (secondary).

Who is responsible for what: the contract, the findings and the undertakings

The AOD separates three things: who was contracted for what (paragraphs 5 to 8), whose conduct the Attorney General found wanting, and what each company now undertakes. They do not line up neatly, and the contract split is the surprising part. XTIUM was "contractually responsible for the management of (not security for) BCHP's other IT systems" (paragraph 6). The AOD adds that managed service providers "generally do not provide security services, such as threat detection, threat prevention, risk management, scanning, incident response, and compliance", which a "managed security service provider" does (paragraph 8). BCHP's other vendor was responsible for "both management of and security for" the active patient records system, a system that was not breached (paragraph 5).

On the AOD's wording, nobody is named as contracted to secure the systems that were breached. The 2023 audit says something close in other words: it found "the lack of clarity regarding whether XTIUM or BCHP was providing specific services to secure the BCHP information system" (paragraph 25). That is this briefing's reading, not an AOD finding. What the AOD does find is a duty that does not depend on the contract: even though BCHP lacked policies for administrative accounts, "XTIUM should have applied common standard practices to secure the client accounts it used" (paragraph 19).

The AOD's findings by company, with paragraph numbers. Quotations are from the AOD.

Matter	Aimed at XTIUM	Aimed at BCHP
Contract role	"management of (not security for)" BCHP's other IT systems (para 6).	Two vendors; the first for management and security of the records system (para 5). Only two BCHP employees oversaw IT and information security (para 4).
The way in	A remote support tool not implemented with all the vendor-recommended measures; XTIUM "did not have sufficient logging or monitoring" for misuse of that tool's account (paras 17, 18).	BCHP was reached through XTIUM. Only BCHP had a data breach, because BCHP "failed to reasonably safeguard its own systems" (para 22).
Administrative accounts	"a single shared administrative account with unrestricted access and unlimited privileges"; XTIUM "neither requested these BCHP policies nor followed common standard practices" (para 19).	Four more unrestricted administrative accounts, "non-human service accounts", compromised (para 23). Did not reasonably use common policies on permissions, segmentation, least privilege, access control, account monitoring or privileged account management (para 24, a to f).
Logs and forensics	Logging of that account "so poor that it prevented meaningful forensic analysis of the attack" (para 19).	Did not reasonably use managed detection and response (para 24, g).
Vendor oversight	Not a separate finding.	Did not reasonably use vendor assessments or responsibility assignment matrixes (para 24, i and j). The 2023 audit found no security vendor assessment programme and unclear security roles (para 25).
The data	About 1,000 XTIUM employee records exfiltrated (paras 15, 20).	An unencrypted archive; executives "aware for over two years" of it (para 26); no reasonable response to the 2023 audit (para 25).
Candour	"cooperated" but "at times provided incorrect, incomplete, or inconsistent information" (para 28), said of both companies.	The same sentence (para 28).
Findings of violation	Executive Law 63(12), General Business Law 899-bb and the HIPAA Security Rule (paras 31, 32), against both companies.	The same paragraphs.

Both press releases call XTIUM "an IT management company that provided network security services to BCHP". Paragraphs 6 and 8 of the AOD say the opposite for BCHP's other IT systems. The releases are summaries and the AOD is the signed document, so where they differ this briefing follows the AOD and says so (see the wording table below).

The numbers side by side: what each counts, and where they disagree

Several counts circulate, and they measure different things: records, New Yorkers, residents of two states, individuals reported by a supplier, and members of a class. The first table is about people and records, the second about money. Every derived figure is marked.

Counts in the AOD, the two releases, the HHS portal and the class settlement papers, read on 18 October 2026.

Figure	Where it is stated, and what it counts	Caveat
825,000	AOD para 13 and both releases: "approximately 825,000 New Yorkers", records exfiltrated.	New Yorkers only. Any Connecticut or other-state count is separate or absent.
820,000	AOD para 27: the archive "contained the personal information of approximately 820,000 New Yorkers".	5,000 fewer than para 13 (derived, 0.6 per cent). The AOD does not say why they differ.
170,000	AOD paras 13, 27 and the New York release: "over 170,000" with a social security number and/or driver's licence number.	"records" in para 13, "residents" in the release. 20.6 per cent of 825,000 (derived).
62,871	Both releases: Connecticut residents whose records were stolen. Not in the AOD.	Connecticut's agreement was not read. Whether this is people or records is not stated.
887,871	825,000 plus 62,871 (derived).	Adds two units. No document gives this figure.
909,469	HHS OCR portal archive: ATSG, Inc, New York, Business Associate, "Hacking/IT Incident", "Network Server", submitted 10/04/2024.	A supplier's report, all states. 21,598 above the sum of the two release counts (derived); the AOD does not explain.
918,000	HIPAA Journal and GovInfoSecurity, from the class settlement papers: patients and employees "in 63 states and provinces" (GovInfoSecurity).	Secondary. Includes employees. 8,531 above the HHS figure (derived).
Over a million	AOD para 26 and both releases: payment or billing records in the unencrypted archive.	Records, not people. No ratio of records to people is stated.
Over 4,000; about 1,000	AOD para 27: BCHP employee records from a different database. Paras 15, 20: about 1,000 XTIUM employee records, over 200 New Yorkers; the Connecticut release adds 16 Connecticut residents.	Small beside the patient counts. In the class papers employees sit inside the 918,000.
18 and 1	AOD para 9: 18 client systems infiltrated; "only BCHP suffered a data breach". Releases: access to "18 of its clients' networks, including BCHP's".	17 client systems without a data breach (derived). What was done in them is not stated.

Money in the AOD, the two releases and the class settlement papers, read on 18 October 2026.

Figure	Where it is stated	Caveat
$2.7 million	Both releases ("secured"). AOD para 58(a): an initial payment of $2,700,000 "by XTIUM and BCHP" within 30 days of the effective date.	Due 15 November 2026, a Sunday (derived). The AOD does not say how it divides between the two companies.
$2.1 million and $540,000	Both releases: a "penalty" to New York and to Connecticut.	They add to $2,640,000 (derived), $60,000 short of $2.7 million. No document explains the gap. The AOD calls the money "penalties and costs" and divides it "in an amount designated by the Attorneys General" (para 58).
$1,300,000 suspended	AOD para 58(c): BCHP only; "immediately due and payable within 60 days if the OAG finds that BCHP materially breached this Assurance within 10 years". Releases: $1,040,000 to New York and $260,000 to Connecticut.	The releases say "if it violates the terms". The AOD says a material breach found by the OAG. The release figures add to $1,300,000 (derived). Ten years runs to 16 October 2036 (derived).
$4,000,000	AOD para 58: "a total of four million dollars ($4,000,000) in penalties and costs".	The announced $2.7 million is 67.5 per cent of it (derived). Neither release states $4 million.
$5.15 million	Class action settlement (HIPAA Journal, GovInfoSecurity): a fund for fees of up to $1,716,667, costs, monitoring and payments to class members.	Secondary. A separate case with separate parties and no admission. $5,150,000 / 918,000 = $5.61 gross (derived).
About $3 a head	$2,700,000 / 887,871 = $3.04 (derived).	For scale only. The money goes to the two states, not to the people; no harm is measured; the units are mixed.

Four readings follow. The first two are from the record, the third is derived and the fourth is inference.

The AOD gives two counts for New Yorkers, 5,000 apart. Paragraph 13 says approximately 825,000 and paragraph 27 approximately 820,000, in the same document. The gap is 0.6 per cent (derived). Paragraph 27 is about the archive, and the AOD counts employee records separately: over 4,000 BCHP employee records from a different database (paragraph 27) and over 200 New Yorkers among XTIUM's employees (paragraph 15). Those are of the same order as the gap and could explain it, but the AOD does not say so (inference). Either way, a round number in a press release is a rounding of a figure the AOD itself states two ways.

No document ties the three large counts together. The releases give 887,871 across two states (derived); HHS lists 909,469 individuals for a supplier; the class papers say about 918,000. The 21,598 between the first two (derived) could be residents of other states, employees, or a difference in how each was counted. None of the sources says which.

The announced $2.7 million is two-thirds of the number on paper. The AOD's total is $4,000,000. The other 32.5 per cent (derived) is suspended for ten years and payable only if the OAG finds a material breach. Spread over the releases' 887,871 people the announced sum is about $3.04 each (derived), and the full $4 million about $4.51. That is scale, not a measure of harm or a payment to anyone.

Records, people and files are different units. The AOD says "records" for the archive, "New Yorkers" for the count and "employee records" for staff. A person can have several billing records, and a household can share a guarantor. Without the file list, no figure in one unit can be turned into another. This is inference.

The timeline: one warning, a week of decisions, and 770 days to the agreement

The diagram sets the week of 6 to 13 September 2024 to scale inside the longer sequence. Every day count is worked out with Python's datetime module (calc.py) and is marked derived wherever it appears. Dates come from the AOD (paragraphs 10, 11 and 78 and the signature pages), the HHS breach portal, and the press releases. BCHP's letters on 4 October 2024 rest on The Record and HIPAA Journal citing BCHP's own notice, so they are secondary.

The intervals between the dates, derived on 18 October 2026 with Python datetime (calc.py, output in calc-output.txt).

Interval	Days (derived)	What it is, and what it is not
6 to 7 Sep 2024	1	XTIUM's warning to BCHP's password reset.
7 to 10 Sep 2024	3	Password reset to BCHP detecting activity. It includes a Sunday.
6 to 10 Sep 2024	4	Warning to detection: the interval in the title. Not a dwell time. The AOD does not say when the intruders reached BCHP.
10 to 13 Sep 2024	3	Detection to "back online" (the AOD says "by September 13").
6 Sep to 4 Oct 2024	28	Warning to BCHP's first letters (secondary date) and to the supplier's HHS report (primary listing).
4 Oct 2024 to 16 Oct 2026	742	Letters and HHS report to the AOD's effective date.
6 Sep 2024 to 16 Oct 2026	770	Warning to the AOD's effective date and the announcement. The date the OAG's investigation began is not stated, so this is not a measure of anyone's delay.
15 to 16 Oct 2026	1	The last company signature to the OAG's signature, the effective date and the announcement.
16 Oct to 15 Nov 2026	30	Effective date to the due date of the initial payment (para 58). 15 November is a Sunday.
Two years before the breach	at least 1,501	The AOD says executives were "aware for over two years before the 2024 breach" and gives no date. Two years before 6 September 2024 is 6 September 2022, and before 1 August 2024 is 1 August 2022 (derived). From 6 September 2022 to the AOD is at least 1,501 days (derived). It is a floor on a claim, not a measured duration.

Four points on the dates. First, the warning came on a Friday and the detection on a Tuesday, so the four days include a Saturday and a Sunday (derived). That establishes nothing about cause. Second, the AOD says BCHP detected the activity on 10 September. Secondary accounts of BCHP's notice differ: HIPAA Journal, TechTarget and The Record say BCHP, GovInfoSecurity says one of BCHP's IT vendors had detected it. BCHP's page was not read, so the difference is unresolved. Third, the HHS listing for ATSG, Inc is dated 4 October 2024, the same day The Record and HIPAA Journal give for BCHP's letters, 28 days after the warning (derived). The AOD gives no date for BCHP's notices to people or to any regulator. Fourth, the knowledge claim is undated. On the AOD's wording the awareness began before August 2022 (derived), earlier than the 2023 audit. The AOD does not say who knew, or whether the audit findings reached them.

Who said what, and what each rests on

Statements by source, read on 18 October 2026. Secondary reports are marked.

Who	What they say	What it rests on
The New York OAG, in the AOD	Findings (paras 1 to 32) and relief (paras 35 to 58). "OAG finds that XTIUM and BCHP's conduct violated Executive Law § 63(12) and GBL § 899-bb" and the HIPAA Security Rule (paras 31, 32).	"the OAG's own factual investigation" and representations by the respondents and their counsel (para 66). A third-party investigation is cited for the archive (para 12); its report is not published.
BCHP and XTIUM, in the AOD	They "neither admit nor deny" the findings (para 33). The AOD "should not be construed, as an admission of liability" (para 61). Each agrees not to make "any public statement denying, directly or indirectly, any finding" (para 70).	The signed AOD. Para 70 keeps each company's right to take positions in litigation the OAG is not part of.
BCHP and XTIUM, since	No statement about the agreement found.	XTIUM's newsroom page, read at 10:17 BST on 18 October, carries none. BCHP's pages could not be read.
The Connecticut AG, in the release	62,871 Connecticut residents; 16 Connecticut XTIUM employees; $540,000. XTIUM "is still unable to confirm how hackers accessed its system".	A press release. The Connecticut agreement is not linked and was not read.
The New York AG, in the release	"BCHP knew its data security features were inadequate but did not fix them". XTIUM "is still unable to confirm how hackers accessed its system".	A press release. See the wording table below.
HHS OCR portal	ATSG, Inc, a New York business associate, reported a hacking or IT incident on a network server affecting 909,469 individuals, submitted 4 October 2024.	A primary listing. The AOD does not mention it. ATSG matches the initials of the AOD's Axispoint Technology Solutions Group, Inc., and the secondary reports call ATSG Inc the supplier now named XTIUM.
BCHP's notice, as reported	XTIUM told BCHP of unusual activity on 6 September; BCHP detected unauthorised activity on 10 September; letters from 4 October; the electronic medical records system was not affected.	The Record, TechTarget, HIPAA Journal and GovInfoSecurity (secondary). BCHP's page was not read.
A criminal group, as reported	GovInfoSecurity: BianLian listed BCHP as a victim on 15 October 2024, claiming data. HIPAA Journal: the listing was later removed, which it says suggests a ransom was paid.	A claim, and an inference, in secondary reporting. No leak site was visited. The AOD names no actor.
The class action, as reported	$5.15 million; the defendants "maintain there was no wrongdoing and no liability" (HIPAA Journal); the final hearing was set for 10 December 2025.	HIPAA Journal (6 August 2025) and GovInfoSecurity (11 August 2025). What happened at the hearing is not verified.
MLex	"will pay a combined $2.7 million penalty".	A paywalled article; only the public summary was read.

Two interests are plain. The Attorneys General announce enforcement outcomes, so their releases are written to show the result. BCHP and XTIUM have agreed not to deny the findings in public, so silence from them is what the AOD asks for, not evidence of agreement. The releases also add "still" to the AOD's present-tense "cannot definitively confirm". Whether XTIUM has said anything since the attack on the point is not stated.

Where the releases and the AOD word things differently

The two releases (identical except where marked) set against the AOD, read on 18 October 2026.

Topic	The releases say	The AOD says
XTIUM's role	"an IT management company that provided network security services to BCHP".	"contractually responsible for the management of (not security for)" BCHP's other IT systems (para 6).
How long executives knew	"at least two years before the breach".	"aware for over two years before the 2024 breach" (para 26).
What BCHP did about it	New York: "did not fix them". Connecticut, quoting the same speaker: "did nothing to fix them".	BCHP "did not reasonably respond to those audit findings, which contributed to the subsequent data breach" (para 25); the archive "remained essentially unprotected for years" (para 26).
The data	"Hackers stole the records of approximately 825,000 New York and 62,871 Connecticut residents" (New York release).	"accessed and exfiltrated"; 825,000 and 820,000, New Yorkers only (paras 12, 13, 27).
The way in	XTIUM "is still unable to confirm how hackers accessed its system".	"cannot definitively confirm", and the system was accessed "through its implementation of a third party remote support tool" (paras 17, 18).
The money	"secured $2.7 million"; a $2.1 million penalty to New York and $540,000 to Connecticut.	"a total of four million dollars ($4,000,000) in penalties and costs": $2,700,000 initial, $1,300,000 suspended (para 58).
The suspended sum	BCHP "must pay an additional $1,040,000 to New York and $260,000 to Connecticut if it violates the terms of the settlement".	Due "if the OAG finds that BCHP materially breached this Assurance within 10 years" (para 58(c)).
Who is bound	"the companies must adopt a series of measures".	Most undertakings bind each respondent. The certification and the suspended payment bind BCHP alone (paras 56, 58(c)).
The 18 networks	XTIUM's breach "allowed hackers to access 18 of its clients' networks, including BCHP's".	18 client systems infiltrated, and "only BCHP suffered a data breach" (para 9).

None of these differences is an error in a legal sense: a release is a summary. They matter because the releases are what most readers will see. The "network security services" line in particular would lead a reader to the opposite of the AOD's contract split. "Did nothing to fix them" is a stronger sentence than the AOD's "did not reasonably respond to those audit findings", which leaves room for a partial response. The two quotations are attributed to the same speaker in two releases issued on the same day, so the two texts differ from each other as well as from the AOD.

Five labels, and what the record shows behind each

A label, comforting or alarming, is not a control. Five appear in this story. Two are in the AOD, two in the releases, and one is both.

Labels in the story, where each appears and what the record shows.

Label	Where it appears	What the record shows
"managed service provider"	AOD para 8; the releases say "IT management company" that provided "network security services".	The AOD says managed service providers "generally do not provide security services". A managed contract is not a security contract, and the label does not tell a customer who secures what. The AOD still holds XTIUM to "common standard practices to secure the client accounts it used" (para 19).
"secured $2.7 million" and "settlement"	Both releases.	$2.7 million is the initial payment. The total on paper is $4 million and $1.3 million of it is suspended for ten years, payable only if the OAG finds a material breach. The AOD's own title is an "Assurance of Discontinuance", accepted "in lieu of commencing a statutory proceeding" (para 34).
"neither admit nor deny"	AOD paras 33, 61.	Neither company admits the findings and neither may deny them in public (para 70). The findings therefore stand as the OAG's account. Acceptance "is not an approval or endorsement" of either company's policies (para 62).
"zero trust"	AOD para 37: the security program "shall be designed, modified, and implemented in accordance with the principles of zero trust architecture".	The slogan is general. The paragraphs that follow are specific: multifactor authentication "or a reasonably equivalent control", no credential "accessed by more than one individual's account", non-human accounts "inaccessible to human login" (para 45). The paragraph is the control.
"hackers stole"	The New York release.	The AOD says "threat actors" "accessed and exfiltrated". Neither document says the data was sold or published.

What each company agreed to do, and when

The relief is where the AOD is most specific, and it reads as a list of what the findings say was missing. Deadlines are counted from the effective date, 16 October 2026 (derived).

Undertakings in the AOD, with paragraph numbers. "Each" means each respondent. Dates are derived from the effective date.

Undertaking	Who	When
Pay the initial $2,700,000 (para 58)	XTIUM and BCHP together	Within 30 days: 15 November 2026.
A suspended $1,300,000 (para 58)	BCHP	Payable within 60 days if the OAG finds a material breach within 10 years: to 16 October 2036.
A written information security program "in accordance with the principles of zero trust architecture", assessed at least annually (para 37)	Each	Ongoing.
A designated chief information security officer reporting at least quarterly to the chief executive and at least semi-annually to the board (para 38)	Each	Ongoing.
Account access management for all accounts, "service accounts, non-human accounts" included: least privilege, monitoring and logging, managed detection and response (para 40)	Each	Within 90 days: 14 January 2027.
A data inventory of every place private information is processed (para 41)	Each	Within 180 days: 14 April 2027.
Multifactor authentication or an equivalent; no credential accessible to more than one individual's account; non-human accounts inaccessible to human login (para 45)	Each	Ongoing.
Centralised logging and alerting. Logs "should be immediately accessible for a period of at least 90 days and stored for at least one year" (para 46)	Each	Ongoing.
Encrypt consumer personal information; segment networks (paras 47, 48)	Each	Ongoing.
Written vendor policies with vendor and client risk assessments, reviewed annually (para 43), and reasonable steps to make a contracted third party meet these terms (para 50)	Each	Annual.
An independent third-party assessment, then annually for three years; reports kept six years (paras 51, 52)	Each	First within 180 days: 14 April 2027.
A compliance certification under penalty of perjury, signed by the chief executive, chief operating officer and chief information security officer (para 56)	BCHP only	First within one year (16 October 2027), then annually for five years, and on request for four more.

These are one US state's agreed minimums for two US companies, not a UK standard. They are specific enough to turn into questions for a supplier, and none is exotic: no shared credentials, no human logins on service accounts, a year of logs, encryption of what is kept.

The class action, the HHS listing and the other lists

The class action (secondary). HIPAA Journal (6 August 2025) and GovInfoSecurity (11 August 2025) report that BCHP and ATSG Inc, the supplier now called XTIUM, agreed to a $5.15 million settlement of a consolidated class action in the Supreme Court of the State of New York, County of Westchester, over the September 2024 incident, affecting about 918,000 people. The defendants maintain there was no wrongdoing and no liability. GovInfoSecurity notes that the settlement has no mandate to improve security, only a duty to disclose the enhancements already made to class counsel before final approval. The final hearing was set for 10 December 2025, which has passed. A local news aggregator, Hoodline, says final approval came in December 2025 and payments began on 29 April 2026, citing the settlement website. That website answered scripted requests with a bot check, which was not bypassed, so the status after the hearing is not verified here.

What the class action is not. It is a private case with different parties, a different count and no admission. It does not change what the AOD finds, and the AOD does not mention it.

Public listing pages read on 18 October 2026 for an entry under BCHP, ATSG or XTIUM. Nothing was submitted to any of them.

Listing page	What was read	Result
HHS OCR breach portal, Archive tab	Sorted by individuals affected, 100 rows a page, using the table's own sort and page links. No search or filing form was used.	ATSG, Inc, NY, Business Associate, 909469, 10/04/2024, Hacking/IT Incident, Network Server. Whether BCHP has an entry of its own was not established.
Oregon Department of Justice	The list, which runs from December 2014 to 8 October 2026.	No entry for BCHP, ATSG or XTIUM.
California Attorney General	The recent-entries page.	No entry.
Vermont Attorney General	Entries from 17 April to 16 October 2026.	No entry. The list starts after the 2024 notices.
Washington Attorney General	Entries from 10 July 2025 to 11 September 2026.	No entry. The list starts after the 2024 notices.
Maine Attorney General	The page states that its public-facing database is offline.	Not readable.
New Hampshire Department of Justice	Returned 403 to a scripted request.	Not read, and not bypassed.

The HHS row is the one primary record of a regulator being told. It shows a supplier, not BCHP, as the reporting entity, in line with the HIPAA Journal's account that the incident "was reported to the HHS' Office for Civil Rights by the IT vendor". Why BCHP does not appear is not stated anywhere read. The silence of the state lists says little, because most of them do not reach back to October 2024.

UK schools, GP practices, trusts, charities and their suppliers: what the guidance says

UK law did not apply to this case and nothing here claims it did: it is a New York agreement about a New York practice. The reason for a UK section is the shape of the failures: a managed IT supplier with a shared administrative account, poor sign-in logs, a contract that said management and not security, and an old archive nobody encrypted. The table sets what the NCSC and the ICO say about each, as read on 18 October 2026.

UK guidance as read on ncsc.gov.uk and ico.org.uk on 18 October 2026. The right-hand column is this briefing's reading.

Source	What it says	Set against the AOD
NCSC, Choosing a managed service provider (MSP), 24 November 2025, for small and medium-sized organisations	"A matrix of responsibilities detailing what the MSP will do and what is expected from you as the customer is good practice." "Without clear contracts, responsibilities become ambiguous." Check that MSPs "also protect their access to your systems. They should also have 2SV in place." On logs, ask whether they are kept, for how long, and whether you "can access this logging data if required".	The AOD's 2023 audit found it unclear who secured what (para 25). XTIUM's sign-in logging was too weak to confirm how it was entered (para 18).
NCSC, Using MSPs to administer your cloud services, 10 January 2023	"A third party is a third attack surface." Ensure that your SOC "can tie specific actions taken in your environment to specific people's accounts (ie that MSPs are not using generic shared management accounts)". The contract should oblige the MSP to tell you of "any possible breach", including "breaches that happened in the MSP's own supply chain".	A single shared administrative account with unrestricted access (para 19). XTIUM's own breach reached BCHP, and BCHP reset user passwords and took no further action (para 10).
ICO, Personal data breaches: a guide	A notifiable breach goes to the ICO "within 72 hours of becoming aware of the breach, where feasible". A processor "must inform you without undue delay as soon as it becomes aware" (Article 33(2)). "If you use a processor, the requirements on breach reporting should be detailed in the contract between you and your processor."	XTIUM told BCHP on 6 September 2024 (para 10). The ICO guide points to the Article 29 Working Party guidelines for when a controller is "aware". Those were not read, so when a UK controller's clock would start on such a notice is not answered here.
ICO, What does it mean if you are a processor?	A processor must "implement appropriate technical and organisational measures to ensure the security of personal data" and notify the controller "without undue delay". "Most controllers will expect to be notified immediately, and may contractually require this."	In the AOD the supplier is a HIPAA business associate. The UK parallel is a processor with direct security duties, which a management-only contract does not remove.
ICO, A guide to data security	"you must choose a data processor that provides sufficient guarantees about its security measures". The contract should let you "audit and inspect the processor, either yourself or an authorised third party". The controller remains "responsible for ensuring compliance with the UK GDPR and this includes what the processor does with the data".	BCHP had no vendor assessment programme (para 24, i). The AOD's vendor undertaking (para 43) and the right-to-audit idea cover the same ground.
ICO, Storage limitation (marked under review because of the Data (Use and Access) Act)	"You must not keep personal data for longer than you need it." Review it "periodically" and "erase or anonymise it when you no longer need it".	An unencrypted archive of over a million billing records that executives were aware of for over two years (para 26). The AOD does not say why it was kept.
ICO, Encryption and data protection	"The UK GDPR doesn't specifically require you to use encryption or encrypt all personal information you hold." It does require secure processing and "includes encryption as an example of an appropriate technical measure".	The AOD simply requires it: respondents "shall encrypt Consumer Personal Information" (para 47). Encryption is an option in UK law and a duty in this agreement.

The NCSC's MSP guide is written for small and medium-sized organisations, and says larger ones should use its cloud security guidance. A GP practice, a charity or a small trust fits the first description. The cloud blog is addressed to larger organisations and the public sector. Between them they cover the questions the AOD's findings raise. None of this is a UK finding about XTIUM, BCHP or any named supplier.

Two other supplier cases are on this site. ETS and the California student files is a supplier's file-transfer site and one credential used at various times over four months, with no student count stated. ConnectWise Cloud Backup is an MSP-tooling incident under way now. It is a separate incident, and nothing read here connects it to this one: the AOD names no tool and no vendor, so no link should be drawn.

What to do, in the order worth doing

These are this briefing's own questions for suppliers and for your side of the contract. None is a finding about XTIUM or BCHP. Where UK guidance supports a step, the item says so.

What could not be verified

• BCHP's own notice. Its page answers scripted requests with a redirect loop from what appears to be a bot-protection service and was not bypassed. Its contents are read through The Record, TechTarget, HIPAA Journal and GovInfoSecurity, which differ on who detected the 10 September activity. The Internet Archive's availability service returned a rate-limit error, so no archived copy was read.
• Connecticut's agreement. Not linked from Connecticut's release and not found. Every Connecticut figure rests on the two releases.
• The class settlement's status. The settlement website returned a bot check and was not bypassed. The hearing date of 10 December 2025 and the $5.15 million are from August 2025 reports. Hoodline's later claim is unverified.
• MLex. A paywalled article. Only the public summary was read and nothing was bypassed.
• The criminal group's claim. Reported by GovInfoSecurity and HIPAA Journal. No leak site was visited, and the AOD names no actor.
• BCHP's own HHS entry. The portal listing for ATSG, Inc was read. Whether BCHP has a separate entry was not established. The link between ATSG and XTIUM rests on AOD paragraph 6 and the secondary reports.
• DataBreaches.net. Not read and not cited.
• The unexplained $60,000, the split of the $2,700,000, the 5,000 between paragraphs 13 and 27, the day of the infiltration, the tool, the actor, the 17 other clients, and the date executives first knew. Not stated in any source read.
• State lists. Maine's database is offline and New Hampshire returned 403. The other lists named above do not reach back to October 2024 or have no entry.

The question that exposes the gap

If your managed service provider told you on a Friday that it had been breached, which of the accounts it holds in your estate would you reset first, and would you know by Tuesday whether anyone had used one?

Key facts