Pediatric Practice, IT Vendor Settle $5.15M Breach Suit

A New York-based pediatric practice and its managed services vendor have agreed to pay $5.15 million to settle a proposed class action lawsuit stemming from a 2024 data theft attack affecting more than 918,000 people and allegedly carried out by cybercrime gang BianLian.

See Also: Top 10 Technical Predictions for 2025

Under the proposed agreement preliminarily approved by a New York state supreme court judge, ATSG Inc. – which now operates under the name XTIUM – and its client Boston Children’s Health Physicians, LLP have agreed to fund the settlement, while denying any wrongdoing related to the September 2024 hacking incident. A final approval court hearing on the settlement is scheduled Dec. 10.

BCHP is a Valhalla, New York-based multi-specialty pediatric practice with 300 clinicians in 60 New York and Connecticut offices, is affiliated with Boston Children’s Hospital in Boston. ATSG, a New York-based managed IT services firm, was one of BHCP’s third-party network services vendors at the time of the attack, according to court documents.

BCHP said that on Sept. 10, 2024, one of its IT vendors – which the practice did not identify at the time – had detected unauthorized activity on limited parts of the BCHP network.

BCHP said it immediately initiated its incident response protocols, including shutting down its systems as a “protective measure.” The practice’s electronic medical records system is on a separate network and was not affected by the incident, BCHP said (see: Bianlian Ransomware Gang Claims Heist of Pediatric Data).

BCHP’s investigation into the incident found that an “unauthorized third-party” gained access to the practice’s network on Sept. 10, taking certain files from its network.

BCHP in its notice said the files compromised in the incident contained current and former employee, patient and guarantor information. That includes names, Social Security numbers, addresses, dates of birth, driver’s license numbers, medical record numbers, health insurance information, billing information and/or limited treatment information.

On Oct. 15, 2024, BianLian listed BCHP as a victim on its dark website, claiming to have the practice’s data, including finance data, HR data, mailboxes and internal and external email correspondences, database exports, protected health information and personally identifiable records, health insurance records and minors’ data.

ATSG reported the hacking incident as a HIPAA business associate to the U.S. Department of Health and Human Services on Oct. 4, affecting nearly 909,500 people. ATSG did not immediately respond the Information Security Media Group’s request for comment on the settlement and for additional details about the hack, including whether any other clients beyond BCHP were affected.

BCHP also did not immediately respond to ISMG’s request for comment on the settlement and for additional details about the data breach.

Settlement Terms

The settlement documents say the cyberattack affected the information of about 918,000 BCHP patients and employees in 63 states and provinces.

Under the settlement, class members are eligible to receive one of two cash payment options.

Under the first option, each class members may submit a claim for a cash payment up to $5,000 for documented losses related to the incident.

The second option calls for a cash payment of about $100 to class members for undocumented losses. “This value may be increased or decreased based on the number of valid claims received,” the settlement document said.

Settlement class members also may elect to receive two years of complimentary medical data monitoring. That includes medical identity monitoring, real-time alerts and insurance coverage for up to $1 million for medical identity theft.

Six named plaintiffs are slated to receive $2,500 service awards each, and attorneys representing the plaintiffs and class members would receive one-third of the settlement fund, or about $1.71 million.

While the agreement does not include a mandate for BCHP or ATSG to improve their data security practices, prior to final approval of the settlement, the defendants must disclose to class counsel the security enhancements implemented following the cyber incident.

In the aftermath, plaintiffs filed several proposed class action lawsuits against BCHP and ATSG in state and federal courts. The federal cases were dismissed in December and the state cases were consolidated. The consolidated compliant filed in January 2025 alleged, among other claims, that BCHP and ATSG were negligent and violated the New York General Business law in failing to protect plaintiffs and class members’ sensitive health and personal information.

Taking Action

While many similar proposed class action lawsuits involving major health data breaches often lag in the courts for years, some settlements of such cases are being reached much faster. The consolidated class action lawsuit against BCHP and ATSG was settled less than a year after the cyberattack.

“It’s no surprise – at least to me – that settlements are being reached earlier. Litigating these have become more expensive, not less, and it makes economic sense for defendants to settle earlier,” said attorney Steven Teppler, partner and chief cybersecurity legal officer of the law firm Mandelbaum Barrett PC, who was not involved in the BCHP/ATSG case.

Breach cases involving compromises to pediatric protected health information are often particularly concerning, he said. “Without devaluing adult medical information, children’s PHI makes for a much more compelling presentation to a jury. And significantly higher exposure for the defendants,” he said.

“Stolen PHI – minor or adult – can be used to obtain unauthorized medical care, credit and for extortion. For minors, these can be ‘aged’ and used years later,” he said.

Healthcare sector organizations should pay close attention to their upstream vendors, including managed services providers and managed software services provider because the cyber risks posed by these third-parties are growing, he

“Clients should carefully review their service agreements prior to signing. Think indemnification, vendor incident visibility, vendor insurance, to name a few.”