NYC Health + Hospitals Under Investigation for Data Breach of Approximately 1.8 Million Records

Schubert Jonckheer & Kolbe LLP is investigating a data breach that led to unauthorized access to the sensitive information of 1.8 million individuals affiliated with NYC Health + Hospitals (NYCHHC), the largest municipal healthcare system in the United States. 

In November 2025, an attacker exploited a vulnerability in an unnamed third-party vendor to gain access to the network of NYCHHC. The intrusion went undetected until February 2026, during which time the attackers exfiltrated highly sensitive data belonging to approximately 1.8 million individuals. On May 19, 2026, NYCHHC confirmed the breach via a notice published on its website and in reporting by outlets including TechCrunch, and reported the incident to the U.S. Department of Health and Human Services.

NYCHHC has not reported the attack to state attorney general offices, which may have violated federal or state laws. The following data may have been compromised in the breach: medical records, health insurance information, Social Security numbers, government-issued identification, precise geolocation data, and biometric fingerprint and palm print scans.

If your personal information was impacted by this incident, you may be at risk of identity theft and other serious violations of your privacy. As a result, you may be entitled to money damages and an injunction requiring changes to NYCHHC’s cybersecurity practices.

If you received notification of this data breach or are affiliated with NYCHHC and wish to obtain additional information about your legal rights, please fill out the form below.