Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 12:00 PM EST
NYC Health + Hospitals Breach Exposed 1.8 Million Records
Coverage from Morningstar, TechCrunch, and others
Articles
27
Active Days
72
The Topic
A series of breaches and privacy incidents is exposing highly sensitive information through healthcare providers, business associates, public-sector vendors, and poorly handled records. The most significant incidents involve NYC Health + Hospitals, including a major intrusion affecting about 1.8 million people and a separate vendor breach affecting 58,778 patients, while broader reporting shows hacking remains the dominant source of large healthcare breaches. The incidents demonstrate how third-party access, weak monitoring, social engineering, and inadequate records handling can expose medical, identity, biometric, and other difficult-to-replace data.
First Article: 05/18/26
Latest Article: 07/28/26
Summary
- NYC Health + Hospitals reported a breach affecting at least 1.8 million people after attackers accessed systems from November 2025 through February 2026 via an unnamed third-party vendor.
- The exposed NYC data reportedly included medical records, insurance and billing details, government identification documents, fingerprints, palm prints, and potentially precise geolocation data.
- A separate Solventum incident exposed information belonging to 58,778 NYC Health + Hospitals patients, with data reportedly posted on the dark web.
- HHS reporting for March 2026 recorded 44 healthcare breaches affecting more than 1.5 million people; 40 involved hacking or IT-related events.
- The incidents show persistent exposure created by business associates, development and testing environments, employee accounts, and other third-party access paths.
- A Singapore Land Authority vendor incident potentially exposed NRIC numbers and addresses in a dataset intended for testing, while a Pennsylvania borough case involved discarded payroll records.
History
This topic is new, but as new articles are added to it this area will summarize shifts, changes and expansions of the issues.
Featured
05-21-2026
On January 27, 2026, Erie Family Health Centers in Chicago confirmed suspected unauthorized access between December 10, 2025 and January 27, 2026 affecting about 570,000 individuals.
05-18-2026
NYC Health and Hospitals disclosed a months-long vendor-mediated cyberattack detected February 2, 2026, exposing medical, identity, geolocation, and fingerprint data for at least 1.8 million people in New York.
05-19-2026
NYC Health + Hospitals confirmed a November 2025 to February 2026 cyberattack exposing about 1.8 million patients' biometrics, health records, IDs, and precise geolocation.
Timeline: 72 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Shenandoah Borough, led by Mike Cadau, reported a 2024 payroll-record exposure after discarded documents with Social Security numbers were found near Bicentennial Park and in a borough garage.
MCBS reported a September 2025 cyberattack in Atlanta that potentially exposed Social Security numbers and medical data for 1,261,464 individuals.
Singapore Land Authority reported a June IBM vendor incident affecting STARS and eLodgment testing data for about 70,000 people in Singapore.
NYC Health + Hospitals disclosed a March 24, 2026 report of a vendor-based breach detected February 2, 2026 that exposed medical and biometric data for at least 1.8 million people in New York City.
NYC Health + Hospitals disclosed March 24, 2026 that a vendor-linked breach exposed medical records and biometric fingerprints for at least 1.8 million patients and employees.
HHS OCR reported 44 HIPAA breaches in March 2026 affecting 1.5 million individuals, with hacking as the dominant cause.
ShinyHunters claimed responsibility for a Zara breach disclosed in April, using compromised Anodot authentication tokens to exfiltrate 197,400 BigQuery customer records from a former provider.
NYC Health and Hospitals disclosed on 2026 that hackers accessed systems from 25 November 2025, stealing health records, biometric identifiers, and geolocation data affecting at least 1.8 million people.
NYC Health + Hospitals notified nearly 2 million patients in 2024 after a third-party vendor hacking incident led to potential exposure of health, identity, payment, and biometric data in New York City.
Unlimited Technology Systems notified Iowa and other states in July 2026 after a 2025 vendor hack exposed patient and medical information for at least 442,000 people.
NYC Health + Hospitals disclosed a Solventum business associate breach in 2026 exposing protected health information for 58,778 patients after dark-web posting.
NYC Health + Hospitals disclosed a Solventum business-associate breach affecting 58,778 patients after unauthorized protected health information access on or around March 29, 2026.
Craneware disclosed a healthcare-sector data breach after unauthorized access and exfiltration of file names, with reporting via a London Stock Exchange notice.
NYC Health + Hospitals disclosed May 19, 2026 that a third-party vendor vulnerability in November 2025 enabled unauthorized access affecting about 1.8 million individuals.
NYC Health and Hospitals reported a months-long network breach from November 2025 to February 2026 affecting at least 1.8 million people, exposing medical records, IDs, and fingerprint scans.
NYC Health + Hospitals identified a February 2, 2026 breach traced to vendor access that exposed protected health and biometric data for at least 1.8 million people.
⭐⭐⭐
New York City healthcare systems reported a vendor-linked cyberattack in which hackers allegedly stole data tied to nearly 1.8 million patients.
Sturdy Health Inc. disclosed a June 5, 2026 protected health information breach affecting 1,006 U.S. individuals to HHS from Attleboro, Massachusetts.
Senator Bill Cassidy asked NYC Health + Hospitals for details about a months-long hack that allegedly exposed medical records and fingerprint scans for over 1.8 million patients.
One Medical reported June 13 unauthorized access to a third-party file storage system holding archived health records for limited legacy Iora Health patients.
NYC Health + Hospitals notified federal and state regulators after Solventum disclosed unauthorized access to patient PHI around March 29, 2026.
Senate HELP chair Bill Cassidy demanded breach details from NYC Health + Hospitals after a March 24 notification tied to unauthorized access between Nov 25 and Feb 11.
Washington DSHS notified affected individuals in 2024 or later about a March data breach involving unauthorized access by a former employee.
The City of Port Hueneme notified residents in May 2026 after unauthorized access to City files on or about February 23, 2026.