NYC Health and Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people

A significant data breach has been reported by NYC Health and Hospitals, a major public health provider in New York. This incident has compromised the personal information, medical records, and fingerprint scans of at least 1.8 million people. As the largest public health system in the United States, NYC Health and Hospitals serves over a million residents, many of whom are uninsured or rely on state healthcare programs like Medicaid. The healthcare system disclosed the breach to the U.S. Department of Health and Human Services, marking it as one of the largest healthcare data breaches of the year. In recent years, healthcare organizations have increasingly become targets for cybercriminals seeking access to sensitive patient information. The breach was detected on February 2, and it was revealed that hackers had access to the network from November 2025 until February 2026, during which they copied files from the system. The healthcare provider indicated that the breach originated from a third-party vendor, although the identity of this vendor has not been disclosed. The compromised data includes a variety of sensitive information, such as health insurance details, medical records, billing and payment information, and government-issued identity documents like Social Security numbers and driver’s licenses. Alarmingly, the breach also involved the theft of biometric data, including fingerprints and palm prints, which are irreplaceable for the affected individuals. NYC Health and Hospitals has yet to clarify the rationale behind storing biometric information. It is common for potential employees to submit fingerprints for background checks, but it remains uncertain if patient biometrics were also included in the breach. As of Monday morning, the organization’s website was temporarily offline, leading to questions about the cyberattack. Queries regarding the delay in breach detection and any communications from the hackers, including ransom demands, have been posed to NYC Health and Hospitals, but a response has not been provided as of yet. This breach appears to be separate from a previous incident involving the National Association on Drug Abuse Problems (NADAP), which affected over 5,000 patients. According to the FBI’s latest annual cybercrime report, healthcare organizations remain prime targets for ransomware attacks, as evidenced by a previous incident where Russian-linked hackers stole medical and billing information from Change Healthcare, impacting over 190 million Americans. This ongoing trend highlights the urgent need for enhanced cybersecurity measures within the healthcare sector.