Data Breach at NYC Health + Hospitals

Between November 25, 2025, and February 11, 2026, NYC Health + Hospitals, the largest municipal public health system in the United States, experienced a cybersecurity incident that allowed an unauthorized actor to access certain systems on its computer network and copy files stored on them. The organization detected suspicious activity on February 2, 2026, at which point it initiated containment and investigation measures. According to information published by the organization itself, initial analyses suggest that the access may have occurred as a result of a security breach at a third-party vendor, although the investigation was still ongoing at the time of the official notification.
The incident potentially affected patients and others whose data was stored on the compromised systems. The information exposed varied by individual and included personal data, protected health information, health insurance data, billing and payment information, official identification numbers, Social Security numbers, and, in some cases, biometric data such as fingerprints and palm prints. Subsequently, NYC Health + Hospitals confirmed that the breach affected at least 1.8 million people. In response, the organization secured its network, hired external cybersecurity specialists to conduct a forensic investigation, reviewed the affected files, reset compromised access credentials, strengthened its detection systems, and updated certain remote access policies. In addition, it established support and information channels for potentially affected individuals.
Regarding the current status of the incident, NYC Health + Hospitals has indicated that the investigation into the full scope of the breach and the affected data was ongoing at the time of the organization’s public statements. The organization has acknowledged the exposure of sensitive information and has continued to notify those affected as the analysis of the compromised systems progressed. It has also maintained a dedicated hotline for inquiries related to the incident and has indicated that it will update the available information if new relevant details are confirmed.