NYC Health + Hospitals (NYCHHC), the healthcare system of New York City and the largest municipal healthcare network in the United States, has confirmed it suffered a cyberattack that resulted in the loss of highly sensitive data on 1.8 million people. Among the stolen data are fingerprints and palm prints, which can never be changed, making this breach even more disruptive. This is the latest in a growing number of major data breaches added to the healthcare data breach tracker maintained by the US Department of Health and Human Services (HHS).[1]
All these breaches were disclosed in the last few months, but the number of affected individuals has only been made public recently by the HHS breach tracker. The largest incident affects the New York City Health and Hospitals Corporation, which in a March press release disclosed a data breach detected on 2 February 2026. An investigation found that threat actors had access to its systems via a third-party vendor between November 2025 and February 2026. Exposed information includes personal, health insurance, medical, biometric, and financial information.
According to the HHS tracker, the NYC Health and Hospitals data breach affects 1.8 million individuals. Erie Family Health Centers in Chicago, Illinois, detected a hacker attack in January. A probe showed that hackers had access to its network between 10 December 2025 and late January 2026.
Compromised information, the healthcare organization said in a Notice of Data Incident, includes names, phone numbers, email addresses, SSNs, driver’s license numbers, passport numbers, online account credentials, financial information, and medical information.
The HHS tracker shows that the hack has affected 570k individuals. A breach at Florida Physician Specialists reportedly affects 276,000. The organization said in a notification on its website that hackers had access to its network for two days in November 2025, gaining access to information such as names, SSNs, driver’s license numbers, financial information, and medical information.
- Coastal Carolina Health Care in North Carolina and Western Orthopedics in Colorado each reported data breaches impacting roughly 110,000 people.
- A breach at Nacogdoches Memorial Hospital in Texas affects 2.5 million individuals, according to the HHS tracker. However, it was previously reported that 250,000 individuals were affected, suggesting a possible typo in the figure.
The other figures may be updated as well. Recently, a small dermatology clinic in Arizona was reported to have suffered a data breach affecting 3 million people. The number was later updated on the HHS tracker to 500. None of these data breaches have been claimed by any known cybercrime groups.
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/millions-hit-by-a-number-of-us-healthcare-data-breaches-9454.html
Comments