Senate committee chair seeks details on NYC hospital system data breach

The letter, sent to Mitchell Katz, requested details on security protocols, federal notification timing, the internal investigation, and assistance offered to affected individuals. Responses are due by June 18.

Breach timeline and scope Hackers accessed the system from at least November 2025 through February 2026. They obtained medical records, fingerprint scans, and billing data. NYC Health + Hospitals said it reset credentials, added detection rules, and updated remote-access policies after discovering the intrusion.

Committee request and response The letter noted that hostile actors increasingly use artificial intelligence and stressed the need for stronger safeguards in health care. It also asked whether the system is adopting practices used in other critical industries.

An NYC Health + Hospitals spokesperson said patient and employee safety is paramount and that the system alerted staff, notified the public, informed authorities, and offered credit-monitoring tools to those affected. The same committee chair has previously examined other health-care data incidents and sponsored legislation aimed at improving cybersecurity across the sector.