OrthopedicsNY
Disclosed Feb 23, 20242 years ago656,086 affectedSettled
Cyberattack exposed 650,000+ patients and staff; USD 500,000 NY AG
Attackers stole data from Capital Region orthopedic practice OrthopedicsNY, exposing information of more than 650,000 patients and employees. It paid USD 500,000 and must strengthen security.
What is known
| People affected | 656,086 (as reported to HHS) |
|---|---|
| Disclosed | Feb 23, 2024 |
| Attack | Hacking |
| Data exposed | Health, Names, Employment |
| Sector | Healthcare · US |
| Status | Settled |
| Lawsuit or fine | USD 500,000 NY AG penalty (Dec 2025) (about $500K) |
Sources
| Source | |
|---|---|
| NY AG: USD 500,000 from Capital Region health care providerag.ny.gov · Regulator | Regulator |
| Vermont Attorney General: 2024-12-17 OrthopedicsNY Data Breach Notice to Consumersago.vermont.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): OrthopedicsNY (Healthcare Provider, NY)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Feb 23, 2024 | 656,086 |
| Vermont AGresidents of VT | Dec 17, 2024 | |
| Researchtotal | Dec 26, 2025 | 650,000 |
History of this record
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 650000 to 656086 · backfill source
- 2026-09-25 · disclosed: 2024-12-17 to 2024-02-23 · backfill source
- 2026-09-25 · disclosed: 2025-12-26 to 2024-12-17 · backfill source
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.