NYC Health and Hospitals confirmed that hackers accessed personal and medical data from at least 1.8 million people during a significant security breach. The attack also compromised biometric information, including fingerprints, marking one of 2026's largest healthcare data breaches.
The New York public healthcare system disclosed the breach this week, revealing the scope of unauthorized access to its patient database. Compromised data includes names, addresses, Social Security numbers, and medical records spanning the system's patient population.
Biometric information stolen in the attack presents heightened security concerns. Fingerprint data, unlike passwords, cannot be easily changed if compromised. The theft of such data could expose patients to identity theft, fraud, and unauthorized access to secure facilities or systems that use fingerprint authentication.
NYC Health and Hospitals operates the largest municipal hospital system in the United States, serving millions of New Yorkers annually. The breach affects patients who received care across the system's facilities over an extended period.
The healthcare organization has not yet publicly identified the attackers or disclosed the attack method. Investigation into the incident is ongoing. The system said it is notifying affected patients and offering credit monitoring services as a precautionary measure.
The breach adds to a growing list of major healthcare data incidents in recent years. Patient medical records remain high-value targets for cybercriminals due to the sensitive personal information they contain and the difficulty patients face in remedying unauthorized access.
Experts recommend affected individuals monitor accounts for suspicious activity and consider freezing credit as a preventive measure. The incident underscores ongoing challenges healthcare providers face in protecting patient data against evolving cyber threats.
NYC Health and Hospitals has not announced disciplinary actions or systemic changes in response to the breach. The organization continues to investigate the full scope of the incident and assess any ongoing security vulnerabilities.
The ShinyHunters extortion group has published sensitive data from nearly 13 million Carhartt customer accounts stolen earlier this month, according to data breach notification service Have I Been Pwned.
A Russian-speaking ransomware gang called Aur0ra exploited SpaceX's Cursor AI coding assistant to breach at least seven companies between mid-April and late May, according to security firm Gambit Security.
Americans are systematically targeting and disabling Flock Safety cameras across the country in a decentralized protest movement. The surveillance devices face everything from vandalism to theft as public opposition intensifies.
The US Justice Department has dismantled online infrastructure used by Chinese state-sponsored hackers targeting NASA, the Federal Reserve, and the Senate. The action represents a coordinated effort to disrupt cyber operations against American government agencies and critical infrastructure.