A significant data breach has compromised the personal information of at least 1.8 million patients at NYC Health and Hospitals (NYCHHC), the largest public health system in the United States. The organisation confirmed it detected a cyberattack on February 2, 2026, following an investigation that revealed unauthorised access to its systems.
Details of the Breach
According to NYCHHC, an unauthorised individual gained access to its network between November 25, 2025, and February 11, 2026. During this period, files containing sensitive data were copied from the system. The compromised information includes personal data, medical records, payment details, and fingerprint scans.
In a statement, NYCHHC noted: 'Although the investigation is ongoing, it appears that the unauthorised actor may have gained access to NYC Health + Hospitals systems due to a security breach at a third-party vendor.'
Impact on Patients
The healthcare network serves over one million residents across New York City, many of whom rely on Medicaid or lack health insurance. The breach has raised concerns about the security of vulnerable populations.
Response and Security Measures
NYCHHC has since strengthened its security infrastructure to prevent future cyberattacks. Actions taken include resetting compromised account credentials, deploying new detection and protection tools, tightening remote access policies, and introducing enhanced monitoring to counter the tactics allegedly used by the hackers.
This is a developing story, and further updates are expected as the investigation continues.
