<meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>HF Demo</title> <style> body { margin: 0; font-family: Arial, sans-serif; } header { background-color: #2c3e50; color: white; text-align: center; padding: 20px; font-size: 28px; font-weight: bold; } </style>

Hackers stole fingerprints and medical data from 1.8 million people in NYC’s largest public hospital breach

May 18, 2026 Emily Chen Clock

NYC Health and Hospitals Data Breach Exposes 1.8 Million People's Information

Skip to content

Toggle Navigation

News

  • Events

    • TNW Conference
      • June 19 & 20, 2025

  • Spaces

  • Programs

    • Newsletters
    • Partner with us
    • Jobs
    • Contact

Hackers Access Medical and Personal Data of 1.8 Million NYC Residents

May 18, 2026 - 6:06 pm

(Image by: Canva)

Summary:

NYC Health and Hospitals (NYCHHC) revealed that hackers accessed and stole sensitive data from at least 1.8 million individuals in what's being called the largest public healthcare system breach in US history. The breach lasted from November 2025 to February 2026, beginning through a compromised third-party vendor.

Breach Details:

NYCHHC reported the breach to the US Department of Health and Human Services. Hackers gained access to:

  • Medical records, diagnoses, medications, and billing information
  • Social Security numbers, passport and driver’s license numbers
  • Biometric data including fingerprints and palm prints
  • "Precise geolocation data" from user-uploaded photos

The prolonged duration of the breach (over two months) highlights the risks posed by third-party vendor vulnerabilities. While many breaches involve stolen passwords or health insurance details, the permanent nature of biometric data makes this one particularly concerning.

Biometric Data Risks:

Unlike replaceable information like Social Security numbers or passwords, compromised biometric data, including fingerprints, cannot be revoked or reissued. This raises significant security and privacy concerns.

Root Cause Unclear:

While NYCHHC attributed the breach to a third-party vendor, they did not specify which supplier was affected. The exact reasons for storing such sensitive biometric data, especially on a large scale, remain unclear.

The incident serves as a stark reminder of the growing importance of data security in healthcare and the potential long-lasting impact when breaches occur.

Leave a Reply