NYC Health and Hospitals Reports Data Breach Affecting at Least 1.8 Million People

NYC Health and Hospitals reported that a cyberattack allowed hackers to copy files containing personal data, medical records, and fingerprint scans. 8 million people served by the public health system. The organization detected the intrusion on February 2 and secured its network. Hackers had access from November 2025 until that date. The breach originated from an unnamed third-party vendor.

The stolen data includes health insurance details, medical diagnoses, medications, test results, billing records, and payment information. Government-issued documents such as Social Security numbers, passports, and driver's licenses were also taken.

Precise geolocation data was accessed, indicating that photos of identity documents may have included location information. Biometric data, including fingerprints and palm prints, was also compromised. NYC Health and Hospitals stated that prospective employees are generally required to provide fingerprints for background checks.

It remains unclear whether patient biometric data was stored or accessed.

U.S. Department of Health and Human Services. Its website experienced a brief outage on Monday morning. A spokesperson did not respond to questions about the time between initial access and detection or any contact from the attackers.