NYC Health + Hospitals
Disclosed Mar 10, 20266 months ago58,778 affectedConfirmed
NYC Health + Hospitals vendor breach exposes medical data and fingerprints of 1.8M
NYC Health + Hospitals said a third-party vendor breach between November 2025 and February 2026 exposed medical, insurance, billing and ID data plus fingerprints and palm prints of at least 1.8 million people. It reported the breach to HHS.
What is known
| People affected | 58,778 (as reported to HHS) |
|---|---|
| Disclosed | Mar 10, 2026 |
| Discovered | Feb 2, 2026 |
| Attack | Vendor breach |
| Data exposed | Health, Insurance, Financial, Social Security numbers, Government IDs, Biometrics, Location, Names |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| NYC Health + Hospitals says hackers stole medical data and fingerprintstechcrunch.com · News | News |
| Notification of possible PHI disclosuresnychealthandhospitals.org · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): NYC Health + Hospitals (Healthcare Provider, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Mar 10 | 5,086 |
| Researchtotal | May 18 | |
| HHS archivetotal | Jun 18 | 58,778 |
Other breaches at NYC Health + Hospitals
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Jun 6, 2025Jun 6, 20251 year agoHacking | Jun 6, 20251 year ago | Hacking | Healthcare | Confirmed | 5,728 |
| Disclosed Dec 2, 2022Dec 2, 20223 years agoInsider | Dec 2, 20223 years ago | Insider | Healthcare | Confirmed | 3,000 |
| Disclosed Jun 30, 2021Jun 30, 20215 years agoHacking | Jun 30, 20215 years ago | Hacking | Healthcare | Confirmed | 44K |
| Backup tapes with records of 1.7 million patients stolen from contractor's vanFeb 11, 201115 years agoLost or stolen device | Feb 11, 201115 years ago | Lost or stolen device | Healthcare | Confirmed | 1.7M |
History of this record
- 2026-09-25 · disclosed: 2026-05-18 to 2026-03-10 · backfill source
- 2026-09-25 · data_types: ["health","insurance","financial","ssn","government-id","biometrics","location"] to ["health","insurance","financial","ssn","government-id","biometrics","location","names"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 58778 · backfill source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.