NYC Health and Hospitals Suffers Massive Data Breach Affecting 1.8 Million Individuals New York City Health and Hospitals (NYCHH), the largest public health system in the U.S., has disclosed one of the most significant healthcare data breaches of 2026, exposing sensitive personal, medical, financial, and biometric information of at least 1.8 million individuals. The breach, detected on February 2, 2026, revealed unauthorized access to NYCHH systems between November 25, 2025, and February 11, 2026, with attackers exfiltrating files during that period. The compromised data includes protected health information (PHI), identity documents, financial records, and biometric data, such as fingerprints and palm prints details that cannot be replaced if stolen. Affected individuals may have had Social Security numbers, driver’s license numbers, medical records, insurance details, billing information, and even precise geolocation data exposed. The breach’s scale and sensitivity make it one of the most consequential in recent years, given the irrevocable nature of biometric data. NYCHH serves over a million New Yorkers, many of whom are uninsured or rely on public health programs like Medicaid. The organization has not identified the specific third-party vendor believed to be the initial entry point for the attack, though the incident aligns with a growing trend of healthcare breaches originating from compromised vendors. Hospitals increasingly depend on external partners for billing, electronic health records, and cybersecurity services, creating vulnerabilities when those vendors are breached. The timeline of the attack raises concerns: despite detecting suspicious activity on February 2, the unauthorized access persisted until February 11, meaning attackers remained inside the system for 11 weeks and continued operations even after discovery. NYCHH has since implemented enhanced detection tools, credential resets, and updated remote access policies to prevent future intrusions. This breach follows a string of major healthcare incidents in 2026, including breaches at Erie Family Health Centers (570,000 affected), Florida Physician Specialists (276,000), Coastal Carolina Health Care (110,000), and Western Orthopaedics (110,000), highlighting the persistent threat cybercriminals pose to the sector. NYCHH’s investigation remains ongoing, and the full scope of the exposure may evolve as the review of compromised files continues.

NMH Reports Data Breach Affecting Sensitive Personal and Health Information Northwestern Memorial HealthCare (NMH) disclosed a data breach in which unauthorized access to sensitive personal identifiable information (PII) and protected health information (PHI) may have occurred. The incident was first detected on or around May 13, 2025, prompting an internal investigation. NMH confirmed that an unauthorized third party accessed its network between March 19 and May 20, 2025, potentially exposing a range of personal and medical data. The compromised information varies by individual but may include: - Full names - Social Security numbers - Addresses - Dates of birth - Medical records - Health insurance details Following the investigation, NMH published a breach notice on its website and began mailing notification letters to affected individuals. For California residents, the notices include a breakdown of the exposed data and offer complimentary credit monitoring services. The breach highlights ongoing risks to healthcare data security and the potential for long-term identity theft risks for those impacted.

Chicago’s Northwestern Memorial HealthCare became a victim of Elekta’s recent data breach. It exposed oncology patients’ protected health information (PHI) at nine Illinois hospitals. An unauthorized individual gained access to its systems between April 2, 2021, and April 20, 2021, and, acquired a copy of the database that stores some oncology patient information. The information compromised included patient names, dates of birth, Social Security numbers, health insurance information, medical record numbers, and clinical information related to cancer treatment, such as medical histories, physician names, dates of service, treatment plans, diagnoses, and/or prescription information. Financial account and payment card information were not involved.