NYC Health + Hospitals data breach: Hackers stole medical records and fingerprints of 1.8 million patients
A massive NYC Health + Hospitals data breach has exposed the personal and medical information of at least 1.8 million individuals, including sensitive biometric data like fingerprints. The attack, which went undetected for months, ranks among the largest healthcare-related cyber incidents this year.
NYC Health + Hospitals (NYCHHC) is the largest public health system in the United States, serving over one million New Yorkers, many of whom are uninsured or rely on state benefits like Medicaid. The breach was disclosed in a notice filed with the U.S. Department of Health and Human Services, confirming the scale of the incident.
How the NYC Health + Hospitals data breach unfolded
The healthcare system detected the cyberattack on February 2, 2026, after hackers had already infiltrated its network. According to the breach notice, unauthorized access began in November 2025 and persisted until February 2026. During this window, cybercriminals copied files from NYCHHC’s systems before the organization managed to secure its network.
The breach originated from a compromise at a third-party vendor, though NYCHHC has not named the vendor involved. This incident highlights a growing trend: attackers targeting healthcare providers through their supply chain, exploiting weaker security links.
What data was stolen in the healthcare data breach?
The exposed data varies by individual but includes a wide array of sensitive information. Stolen records contain health insurance plan details, policy numbers, medical information such as diagnoses, medications, test results, and imaging scans. Additionally, billing, claims, and payment information were compromised.
Beyond medical data, hackers also accessed government-issued identity documents, including Social Security numbers, passports, and driver’s licenses. The breach notice mentions the theft of “precise geolocation data,” suggesting that user-uploaded photos of identity documents may have revealed exact locations where they were captured.
Most alarming is the theft of biometric data, specifically fingerprints and palm prints. Unlike passwords or credit card numbers, biometric identifiers are permanent and cannot be replaced. NYCHHC did not explain why it stored this data, though prospective employees typically provide fingerprints for criminal background checks. It remains unclear if patient biometrics were also taken.
Why healthcare remains a prime target for cybercriminals
This healthcare data breach is part of a broader pattern. Healthcare organizations have become frequent targets for financially motivated hackers due to the wealth of sensitive patient information they hold. Ransomware attacks, where criminals encrypt data and demand payment, are particularly common.
The FBI’s latest annual cybercrime report covering 2025 confirms that healthcare remains a top target for ransomware attackers. These criminals often steal data before encrypting it, threatening to publish the information if ransoms are not paid.
A notable example is the ransomware attack on UnitedHealth-owned Change Healthcare, which allowed Russian-linked hackers to steal medical and billing information from over 190 million Americans. That incident is considered the largest theft of U.S. medical data in history.
Impact on patients and response efforts
For affected individuals, the consequences are severe. Stolen medical records can be used for identity theft, fraudulent insurance claims, or even blackmail. Biometric data theft is particularly concerning because fingerprints cannot be changed, leaving victims vulnerable for life.
NYCHHC’s website was briefly offline as of Monday morning, complicating communication efforts. A spokesperson did not respond to inquiries about why the breach took months to detect or whether hackers demanded a ransom. The incident appears unrelated to a separate data breach at the National Association on Drug Abuse Problems (NADAP), which affected over 5,000 NYCHHC patients earlier this year.
Patients are advised to monitor their accounts for suspicious activity and consider placing fraud alerts on their credit reports. For more guidance, read our article on protecting your identity after a data breach. Additionally, learn about healthcare data security best practices for organizations.
What NYCHHC patients should do now
If you are a NYCHHC patient, take immediate steps to safeguard your information. Check your health insurance statements for unauthorized claims. Review your credit reports from the three major bureaus: Equifax, Experian, and TransUnion. Consider freezing your credit to prevent new accounts from being opened in your name.
Building on this, be cautious of phishing attempts. Hackers may use stolen data to craft convincing emails or phone calls. Never share personal information unless you are certain of the recipient’s identity.
The NYC Health + Hospitals data breach serves as a stark reminder of the vulnerabilities in healthcare systems. As cyber threats evolve, both providers and patients must remain vigilant to protect sensitive data.
