Loading story…
New York City Health + Hospitals said it is notifying patients after two separate third-party hacking incidents exposed sensitive health and personal data. In the more recent case, disclosed in a March 24 notice, an unnamed vendor suffered a security breach that may have compromised medical, insurance, biometric, financial, and identity information tied to an undisclosed number of patients. The health system said attackers may have retained access to the vendor’s systems for nearly three months before the intrusion was detected.
In a separate notice issued earlier, NYC Health + Hospitals said 5,086 patients were affected by a hacking incident at the National Association on Drug Abuse Programs (NADAP), a care management agency partner. The hospital system said the two breaches were unrelated, while the NADAP incident reportedly affected about 90,000 individuals across multiple clients, underscoring the continuing risk that healthcare providers face from compromises at outside partners and service providers.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
When disclosing the vendor-related incident, NYC Health + Hospitals stated that the unnamed vendor breach and the earlier NADAP breach were separate, unrelated incidents. This clarified attribution and scope across the two third-party compromises.
In a March 24, 2026 notice, NYC Health + Hospitals disclosed a separate third-party security incident involving an unnamed vendor. The organization said attackers had access for nearly three months before detection and that sensitive medical, insurance, biometric, financial, and personal information may have been exposed.
A hacking incident at care management partner National Association on Drug Abuse Programs (NADAP) exposed data affecting NYC Health + Hospitals patients. The breach reportedly impacted about 90,000 individuals across multiple NADAP clients, including 5,086 NYC Health + Hospitals patients.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NYC Health + Hospitals disclosed that attackers accessed its network for nearly three months and copied sensitive files affecting about **1.8 million** people. The intrusion reportedly began around **November 25, 2025** and continued until **February 11, 2026**, with suspicious activity first detected on **February 2**. The organization said the breach appears to have originated through a compromised third-party vendor and later reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights. Stolen information included personal and medical records, insurance and billing details, payment data, government-issued identifiers, precise geolocation data, and biometric data such as **fingerprints** and **palm prints**, raising particular concern because biometric identifiers cannot be reissued once exposed. NYC Health + Hospitals said it engaged external cybersecurity specialists, reset affected credentials, added security technologies, strengthened monitoring and detection rules, updated remote access controls, and is offering **two years** of Kroll identity theft protection and credit monitoring to affected patients and employees.
Jun 29, 2026
Multiple healthcare organizations disclosed **data security incidents** involving potential exposure of patient and personal information. Jackson Hospital and Clinic (Montgomery, Alabama) notified **14,485** individuals about a breach at its former debt-collection vendor **Nationwide Recovery Services**, where suspicious activity was identified in July 2024 and an unauthorized party accessed the vendor’s network between **July 5–15, 2024**. Jackson Hospital stated its own IT systems were not affected, but data shared for collections work may have been compromised, including **names, contact details, dates of birth, Social Security numbers, account/insurance information, and dates of service**; affected individuals were offered credit monitoring and identity theft protection. Separately, **Community Health Action of Staten Island** reported a data security incident that may have involved unauthorized access to sensitive personal and medical information, and **Insight Hospital and Medical Center** (Chicago) reported a cyber incident involving unauthorized access to its network between **Aug. 22 and Sept. 11, 2025**, with potential exposure of patient and financial data. The disclosures underscore ongoing third-party and direct-network intrusion risks in the healthcare sector, with notification timing and scope varying by organization and investigation status.
Jun 29, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026