Loading story…
NYC Health + Hospitals disclosed that an unauthorized party accessed its systems between about November 25, 2025, and February 11, 2026, after suspicious network activity was detected on February 2, 2026. The public notice said files were copied during the intrusion, which the health system indicated appeared linked to a compromise involving an unnamed third-party vendor. The organization reported the incident to the U.S. Department of Health and Human Services as affecting 1.8 million individuals.
LeakNet has now claimed the breach was far larger, alleging it stole 11TB of data tied to more than 12 million people, including medical, financial, biometric, and personal information. Screenshots published by the group reportedly showed databases, spreadsheets, internal messages, and an alleged directory listing, but those materials do not independently verify the scale of the theft or prove that executives knew of a 12 million-record impact. NYC Health + Hospitals had not publicly addressed LeakNet’s July post at the time of reporting, while congressional scrutiny had already intensified after Senator Bill Cassidy sought answers from CEO Mitchell Katz about the breach and notification process.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
On July 27, 2026, LeakNet published screenshots it said showed databases, spreadsheets, internal messages, and a directory listing from NYC Health + Hospitals. The post accompanied claims that 11TB of data tied to more than 12 million people had been stolen, though the article says those claims were unconfirmed.
In June 2026, Senator Bill Cassidy sent a letter seeking answers from CEO Mitchell Katz about the incident and related notifications. The article says the letter did not accuse the organization of concealing a 12 million-person breach.
NYC Health + Hospitals published a press release titled notice of data breach on March 27, 2026. This was a formal public notice related to the incident.
On March 24, 2026, NYC Health + Hospitals publicly disclosed the breach. The organization said an unauthorized party had accessed systems and copied files.
NYC Health + Hospitals said the unauthorized party had access to systems through about February 11, 2026. During that period, files were copied from affected systems.
The health system detected suspicious network activity on February 2, 2026, which led to the discovery of the incident. The unauthorized access period was later described as continuing into February.
NYC Health + Hospitals said an unauthorized party accessed its systems beginning about November 25, 2025, in an intrusion that later involved file copying. The organization later indicated the activity appeared linked to a breach at an unnamed third-party vendor.
NYC Health + Hospitals reported 1.8 million affected individuals to the U.S. Department of Health and Human Services in connection with the breach. The reference does not provide a specific filing date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcenychealthandhospitals.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NYC Health + Hospitals disclosed that attackers accessed its network for nearly three months and copied sensitive files affecting about **1.8 million** people. The intrusion reportedly began around **November 25, 2025** and continued until **February 11, 2026**, with suspicious activity first detected on **February 2**. The organization said the breach appears to have originated through a compromised third-party vendor and later reported the incident to the U.S. Department of Health and Human Services Office for Civil Rights. Stolen information included personal and medical records, insurance and billing details, payment data, government-issued identifiers, precise geolocation data, and biometric data such as **fingerprints** and **palm prints**, raising particular concern because biometric identifiers cannot be reissued once exposed. NYC Health + Hospitals said it engaged external cybersecurity specialists, reset affected credentials, added security technologies, strengthened monitoring and detection rules, updated remote access controls, and is offering **two years** of Kroll identity theft protection and credit monitoring to affected patients and employees.
Jun 29, 2026
New York City Health + Hospitals said it is notifying patients after **two separate third-party hacking incidents** exposed sensitive health and personal data. In the more recent case, disclosed in a March 24 notice, an unnamed vendor suffered a security breach that may have compromised medical, insurance, biometric, financial, and identity information tied to an undisclosed number of patients. The health system said attackers may have retained access to the vendor’s systems for nearly **three months** before the intrusion was detected. In a separate notice issued earlier, NYC Health + Hospitals said **5,086 patients** were affected by a hacking incident at the National Association on Drug Abuse Programs (**NADAP**), a care management agency partner. The hospital system said the two breaches were unrelated, while the NADAP incident reportedly affected about **90,000 individuals** across multiple clients, underscoring the continuing risk that healthcare providers face from compromises at outside partners and service providers.
Jun 29, 2026
Sen. Bill Cassidy, chair of the U.S. Senate health committee, has demanded answers from New York City officials about a 2025 cyberattack on New York City Health + Hospitals that affected **1.8 million individuals**. In a June 4 letter to CEO Mitchell Katz and Mayor Zohran Mamdani, Cassidy asked when the breach was discovered, what cyber and physical security controls were in place, and what remediation steps have been taken or are planned. New York City Health + Hospitals previously said the intrusion appeared to originate from a security breach at an unnamed third-party vendor. Exposed data reportedly included insurance information, medical records, billing claims, Social Security numbers, payment card numbers, and biometric data including fingerprints and palm prints. The incident has drawn congressional attention because the organization is the nation’s largest municipal public health system, serving more than 1 million patients annually across roughly 70 care locations in New York City.
Jun 29, 2026