New York City Health + Hospitals disclosed a data breach that may have exposed patients’ personal and health information after an unauthorized actor accessed its systems for more than two months.
The public health system said it detected suspicious activity Feb. 2 and determined that an unauthorized individual accessed parts of its network between Nov. 25, 2025, and Feb. 11, 2026, copying certain files during that time.
The organization has not yet determined the full scope of the breach, including how many individuals were affected, and said its review of impacted data and individuals is ongoing, according to a March 24 notice.
The potentially exposed information varies by individual but may include health insurance details, medical records, biometric data such as fingerprints and palm prints, and billing or payment information. Other data that may have been accessed includes Social Security numbers, driver’s license numbers, financial account details and online account credentials.
New York City Health + Hospitals said the breach may be linked to a security incident involving a third-party vendor, though the investigation remains ongoing.
In response, the health system said it secured its network, launched an investigation with a cybersecurity firm and engaged a data analytics company to review the compromised files. It also reset credentials for affected accounts, strengthened detection systems and updated remote access policies to prevent similar incidents.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
