NYC Health + Hospitals state hackers stole medical data and fingerprints in breach affecting nearly 1.8 million people

NYC Health + Hospitals has detailed that a months-long data breach allowed hackers to steal personal data, medical records, and fingerprint scans of at least 1.8 million people. NYCHHC, one of the largest public healthcare systems in the United States, provides healthcare to over a million New Yorkers, the majority of whom are uninsured or receive public healthcare benefits.

Healthcare organisations have been repeatedly targeted by financially motivated cybercriminals in recent years in efforts to steal vast amounts of highly sensitive patient, personal, medical, and billing information. NYCHHC said it detected a cyberattack on February 2 and secured its network. It further stated that hackers had access to its systems from November 2025 until February 2026, during which time they were able to access data and copy files.

More from Tech

NYCHHC has further detailed that the exposed data varies by individual and includes patients’ health insurance plans and policy information, medical records, billing, claims, and payment information. In addition, government-issued identity documents such as Social Security numbers, passports, and driver’s licences were also compromised.

Precise geolocation data was also taken, along with biometric information. These details make the breach particularly sensitive. NYCHHC did not provide an explanation for storing biometric data. Prospective NYCHHC employees are generally required to enrol their fingerprints for criminal record checks. An ambiguity over whether patient biometric data was also taken still persists. The NYCHHC website was also briefly offline as of Monday morning.