Loading story…
Sen. Bill Cassidy, chair of the U.S. Senate health committee, has demanded answers from New York City officials about a 2025 cyberattack on New York City Health + Hospitals that affected 1.8 million individuals. In a June 4 letter to CEO Mitchell Katz and Mayor Zohran Mamdani, Cassidy asked when the breach was discovered, what cyber and physical security controls were in place, and what remediation steps have been taken or are planned.
New York City Health + Hospitals previously said the intrusion appeared to originate from a security breach at an unnamed third-party vendor. Exposed data reportedly included insurance information, medical records, billing claims, Social Security numbers, payment card numbers, and biometric data including fingerprints and palm prints. The incident has drawn congressional attention because the organization is the nation’s largest municipal public health system, serving more than 1 million patients annually across roughly 70 care locations in New York City.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
New York City Health + Hospitals disclosed that a 2025 cyberattack affected 1.8 million individuals. The compromised data reportedly included insurance information, medical information, billing claims, Social Security numbers, payment card numbers, and biometric data such as fingerprints and palm prints.
On 2026-06-04, Sen. Bill Cassidy sent a letter to NYC Health CEO Mitchell Katz and Mayor Zohran Mamdani seeking details about the breach, security controls, discovery timing, and remediation steps. The inquiry reflected congressional scrutiny of the incident and broader concern about cyber threats to healthcare.
On 2026-03-24, NYC Health said the attackers appeared to have gained access through a security breach at an unnamed third-party vendor. This statement provided the first cited explanation in the references for the intrusion path.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcehelp.senate.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NYC Health + Hospitals disclosed that attackers accessed its network for nearly three months and copied sensitive files affecting about **1.8 million** people. The intrusion reportedly began around **November 25, 2025** and continued until **February 11, 2026**, with suspicious activity first detected on **February 2**. The organization said the breach appears to have originated through a compromised third-party vendor and later reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights. Stolen information included personal and medical records, insurance and billing details, payment data, government-issued identifiers, precise geolocation data, and biometric data such as **fingerprints** and **palm prints**, raising particular concern because biometric identifiers cannot be reissued once exposed. NYC Health + Hospitals said it engaged external cybersecurity specialists, reset affected credentials, added security technologies, strengthened monitoring and detection rules, updated remote access controls, and is offering **two years** of Kroll identity theft protection and credit monitoring to affected patients and employees.
Jun 29, 2026
New York City Health + Hospitals said it is notifying patients after **two separate third-party hacking incidents** exposed sensitive health and personal data. In the more recent case, disclosed in a March 24 notice, an unnamed vendor suffered a security breach that may have compromised medical, insurance, biometric, financial, and identity information tied to an undisclosed number of patients. The health system said attackers may have retained access to the vendor’s systems for nearly **three months** before the intrusion was detected. In a separate notice issued earlier, NYC Health + Hospitals said **5,086 patients** were affected by a hacking incident at the National Association on Drug Abuse Programs (**NADAP**), a care management agency partner. The hospital system said the two breaches were unrelated, while the NADAP incident reportedly affected about **90,000 individuals** across multiple clients, underscoring the continuing risk that healthcare providers face from compromises at outside partners and service providers.
Jun 29, 2026
NYC Health + Hospitals disclosed that an unauthorized party accessed its systems between about **November 25, 2025, and February 11, 2026**, after suspicious network activity was detected on **February 2, 2026**. The public notice said files were copied during the intrusion, which the health system indicated appeared linked to a compromise involving an unnamed third-party vendor. The organization reported the incident to the U.S. Department of Health and Human Services as affecting **1.8 million individuals**. LeakNet has now claimed the breach was far larger, alleging it stole **11TB** of data tied to more than **12 million people**, including medical, financial, biometric, and personal information. Screenshots published by the group reportedly showed databases, spreadsheets, internal messages, and an alleged directory listing, but those materials do not independently verify the scale of the theft or prove that executives knew of a 12 million-record impact. NYC Health + Hospitals had not publicly addressed LeakNet’s July post at the time of reporting, while congressional scrutiny had already intensified after Senator Bill Cassidy sought answers from CEO Mitchell Katz about the breach and notification process.
Jul 30, 2026