St. John’s Riverside Hospital Data Breach Exposes PII and PHI of Over 2,200 Individuals St. John’s Riverside Hospital, a community-based healthcare provider in Yonkers, New York, disclosed a data breach affecting at least 2,238 individuals across the U.S. The incident, reported to the U.S. Department of Health and Human Services on November 14, 2025, stemmed from unauthorized access to a limited number of employee email accounts. The breach was detected in September 2025 after the hospital identified suspicious activity, including phishing emails and an attempt to reroute payment funds. The compromised accounts contained sensitive data, including personally identifiable information (PII)—such as names, dates of birth, Social Security numbers, driver’s license details, and financial account numbers—as well as protected health information (PHI), including health insurance details, medical conditions, treatment records, and diagnosis information. In response, St. John’s Riverside Hospital took immediate action to secure its systems, including resetting passwords, revoking session tokens, and implementing multifactor authentication. The hospital also engaged cybersecurity professionals to investigate the incident, contain the unauthorized access, and identify affected individuals. The breach has since been remediated.