TechCrunch reports:
New York public health provider NYC Health + Hospitals says a months-long data breach that allowed hackers to steal personal data, medical records, and fingerprints scans affects at least 1.8 million people.
NYCHHC is the largest public health system in the United States and provides healthcare to over a million New Yorkers, the majority of whom are uninsured or receive state healthcare benefits, such as Medicaid.
The healthcare system reported the number to the U.S. Department of Health and Human Services, making it one of the largest healthcare-related data breaches of the year so far. Healthcare organizations have been repeatedly targeted by financially motivated cybercriminals in recent years in efforts to steal their vast banks of highly sensitive patients’ personal, medical, and billing information.
Read more at TechCrunch.
The health system’s website notice indicates that they believe the breach originated with an unnamed vendor, but it was not definitive on that point.
No criminal gang or individual has publicly claimed responsibility for the breach, and the stolen data has not appeared on the dark web. The website notice is silent whether there was any ransom demand, and if so, whether NYCHHC paid it.
The hospital system’s notice was originally posted on March 24, 2026, but it was only this week that the HHS public breach portal revealed that 1.8 million patients had been affected.
