NYC Health + Hospitals vendor breach exposes medical and biometric data of 1.8 million people

On 18 May 2026, NYC Health + Hospitals, the largest public health system in the United States, disclosed a data breach affecting at least 1.8 million people. According to its breach notice, intruders had been inside its IT environment from November 2025 until 2 February 2026, when the activity was detected and the network was locked down. The organization traced the intrusion to an unnamed third-party vendor it contracts with for services.

What was stolen

The breadth of the stolen data makes this one of the most serious healthcare breaches of 2026. The notice lists:

• personal details and government-issued identity documents, including Social Security numbers, passports and driver's licenses
• medical information, including diagnoses, medications, test results and medical imagery
• health insurance plan and policy information, plus billing and claims data
• biometric data, specifically fingerprint and palm-print scans
• precise geolocation data

The health system did not say who was behind the attack or whether it had received any ransom or extortion demand.

Why it matters

Passwords and card numbers can be changed; fingerprints and palm prints cannot. The theft of biometric identifiers alongside medical records and identity documents leaves affected patients exposed to long-term identity fraud with no way to rotate the compromised factor. The incident also shows how a single vendor connection gave attackers roughly three months of undetected access to a public hospital system serving New York City's most vulnerable residents.