NYC Health and Hospitals Data Breach Exposes 1.8 Million People’s Information
Skip to content
Toggle Navigation
News
-
Events
- TNW Conference
- June 19 & 20, 2025
- TNW Conference
-
Spaces
-
Programs
- Newsletters
- Partner with us
- Jobs
- Contact
Hackers Access Medical and Personal Data of 1.8 Million NYC Residents
May 18, 2026 – 6:06 pm
(Image by: Canva)
Summary:
NYC Health and Hospitals (NYCHHC) revealed that hackers accessed and stole sensitive data from at least 1.8 million individuals in what’s being called the largest public healthcare system breach in US history. The breach lasted from November 2025 to February 2026, beginning through a compromised third-party vendor.
Breach Details:
NYCHHC reported the breach to the US Department of Health and Human Services. Hackers gained access to:
- Medical records, diagnoses, medications, and billing information
- Social Security numbers, passport and driver’s license numbers
- Biometric data including fingerprints and palm prints
- "Precise geolocation data" from user-uploaded photos
The prolonged duration of the breach (over two months) highlights the risks posed by third-party vendor vulnerabilities. While many breaches involve stolen passwords or health insurance details, the permanent nature of biometric data makes this one particularly concerning.
Biometric Data Risks:
Unlike replaceable information like Social Security numbers or passwords, compromised biometric data, including fingerprints, cannot be revoked or reissued. This raises significant security and privacy concerns.
Root Cause Unclear:
While NYCHHC attributed the breach to a third-party vendor, they did not specify which supplier was affected. The exact reasons for storing such sensitive biometric data, especially on a large scale, remain unclear.
The incident serves as a stark reminder of the growing importance of data security in healthcare and the potential long-lasting impact when breaches occur.