Breaches and incidentsBriefReported by a reputable outlet, citing the company
NYC Health + Hospitals: vendor-linked intrusion exposes 1.8 million patients and staff, including fingerprints and palm prints
The largest US municipal health system announced on 24 Mar 2026 that it detected suspicious network activity on 2 Feb.
- Disclosed
What happened
- The largest US municipal health system announced on 24 Mar 2026 that it detected suspicious network activity on 2 Feb; unauthorized access ran from 25 Nov 2025 to 11 Feb 2026 (about 11 weeks). About 1.8 million current and former patients and employees are affected per the HHS OCR portal. Data varies by person and includes medical, insurance and billing data, biometric data (fingerprints and palm prints), SSNs, government IDs, precise geolocation, payment card and account data, and online account credentials.
- Root cause: NYC H+H believes initial access came through a security breach at an unnamed third-party vendor.
- Attacker: not named by NYC H+H. The LeakNet extortion group separately claimed an 11 TB archive covering 12 million people; unconfirmed.
- Response: 24 months of credit and identity monitoring, password resets, new detection rules, revised remote-access management policies; class action filed 20 May 2026.
Sources
- https://www.hipaajournal.com/nyc-health-hospitals-data-breach-march-26/
- https://techcrunch.com/2026/05/18/nyc-health-and-hospitals-says-hackers-stole-medical-data-and-fingerprints-during-breach-affecting-at-least-1-8-million-people/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.