New York City-based NYC Health + Hospitals disclosed that a data breach at business associate Solventum Health Information Systems affected 58,778 patients.
The incident involved unauthorized access to protected health information by a threat actor and occurred on or around March 29, 2026, according to a June 11 notice from NYC Health + Hospitals. The medtech company notified the health system of the disclosure April 21.
The accessed information includes patients’ first and last names, addresses, dates of birth, medical record numbers, medical history and diagnoses. On April 19, before notifying NYC Health + Hospitals, the threat actor posted the accessed patient information to the dark web.
Solventum said it has reset compromised employee accounts, rotated passwords, tightened permissions on sensitive information and increased employee training on “vishing” and other social engineering tactics in response to the incident.
“Protecting the privacy and security of the data entrusted to Solventum is a top priority,” a Solventum spokesperson told Becker’s. “We identified and quickly contained a data security incident in late March involving a limited number of employee accounts. We took immediate action to secure our systems, engaged external cybersecurity experts and notified law enforcement. We have not experienced any disruption to our operations or impact to our production systems.”
NYC Health + Hospitals has notified OCR — which posted the notice in July — and the attorneys general of New York, Connecticut and Puerto Rico. The public health system has disclosed three data security incidents in 2026: a breach of its own network affecting up to 1.8 million patients and employees, and two separate vendor breaches — one at care management partner NADAP affecting 5,086 patients, and now this one tied to Solventum.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
