At least 1.8 million individuals are impacted by a significant data breach at NYC Health + Hospitals, the largest public health system in the U.S. The breach, which is among the largest of the year, involved unauthorized access to sensitive personal data, including medical records and biometric information.
The organization reported the incident to the U.S. Department of Health and Human Services, revealing that hackers infiltrated its network between November 2025 and February 2026. A third-party vendor's security lapse allowed the cybercriminals to copy files, including health insurance details, medical history, and government-issued identity documents such as Social Security numbers.
NYCHHC confirmed the breach through a notice on its website, detailing that biometric data like fingerprints and palm prints were also compromised, raising concerns over long-term identity security. Although the healthcare provider did not specify the reasons for retaining this sensitive information, it noted that prospective employees typically submit fingerprints for background checks. As of Monday morning, the organization's website experienced temporary downtime while they addressed the situation.