Thenextweb Massive Data Breach at NYC Health and Hospitals Affects 1.8 Million Patients
Article Content
- •1.8 million individuals affected by the breach, making it one of the largest in 2026.
- •Sensitive data stolen includes medical records, financial information, and biometric data.
- •The breach lasted over two months before detection, highlighting significant security vulnerabilities.
NYC Health and Hospitals reported a significant data breach affecting at least 1.8 million individuals. The breach, which lasted from November 25, 2025, to February 2, 2026, was caused by unauthorized access through a compromised third-party vendor. Sensitive data stolen includes medical records, personal identification, financial information, and biometric data such as fingerprints and palm prints. This incident is one of the largest healthcare data breaches of 2026, raising serious concerns due to the irreversible nature of biometric data theft. The breach was detected on February 2, 2026, prompting immediate security measures. The organization is currently reviewing the affected data and has reported the incident to the U.S. Department of Health and Human Services.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (16)
Following this threat?
Track NYC Health And Hospitals in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…