Active High impact Data breach Checked 1d ago

NYC Health + Hospitals patient data leaked by LeakNet

NYC Health + Hospitals, the largest public hospital system in the US, disclosed that hackers accessed its network from November 2025 to February 2026 and stole personal data, medical records, and fingerprint and palm scans on at least 1.8 million patients and staff. The extortion group LeakNet says it holds a larger archive of 12 million patient records, posted a preview of the stolen files on July 27, 2026, kept posting leak-site updates through August 18, 2026, and claims it has now made the full 11 terabyte archive public. A second proposed class action, filed by a former employee and patient, was reported on August 26, 2026 and seeks a decade of court-ordered cybersecurity oversight of the hospital system. As of September 10, 2026, LeakNet remains active as a group, but no further update specifically about this hospital system was found.

Started
Nov 1, 2025
Latest activity
Sep 6, 2026
Attributed to
LeakNetConfirmed
Where
United States
Sectors
Healthcare, Government
Scale
one public hospital system, at least 1.8 million patients and staff notified

Current status

No credible update about NYC Health + Hospitals was found after 2026-09-06; LeakNet's latest recorded post remains the Katecho post from that date.

Active: Confirmed and still going. Attacker activity or disruption is continuing.

Who is behind it

LeakNet claimed the breach and posted sample data, but NYC Health + Hospitals has not publicly named the group.

Impact

Hackers stole personal information, medical records, and biometric fingerprint and palm scans, data that cannot be reset like a password. LeakNet says it has published the full stolen archive, which would let anyone download the material rather than just see previews, though this claim has not yet been independently confirmed by the hospital system or outside researchers. The new lawsuit states the leaked records include sensitive details such as HIV diagnoses, abortions, suicide attempts, psychiatric care, and sexual assault history.

What to do

Anyone who gets a breach notice from NYC Health + Hospitals should watch for phishing and identity theft attempts using their medical and personal details, since stolen fingerprints cannot be changed like a password.

Timeline

  1. Sep 6, 2026

    RansomLook recorded a new LeakNet post naming Katecho, LLC as a victim. This confirms recent LeakNet activity but does not provide a new update about NYC Health + Hospitals or independently confirm LeakNet's claims about the hospital archive.

    Activeransomlook.io
  2. Aug 26, 2026

    A former NYC Health + Hospitals employee and a patient filed a new proposed class action alleging an 11-week cyberattack exposed intimate medical records, including HIV diagnoses, abortions, suicide attempts, psychiatric care, and sexual assault history, and asking the court to impose a decade of cybersecurity oversight on the hospital system.

    Activelaw.com
  3. Aug 18, 2026

    LeakNet posted a new leak-site update, 'The 11TB NYC Health + Hospitals Archive is Now Public,' claiming it has now made the full stolen archive available, and repeated its earlier claim that the true toll is 12 million records rather than the 1.8 million confirmed by the hospital system. No independent confirmation from NYC Health + Hospitals or outside researchers was found as of this check.

    Activeransomlook.io
  4. Aug 6, 2026

    LeakNet posted another leak-site update, 'Data Exfiltration Diaries: The Shocking Stories Inside NYC Health + Hospitals,' continuing to publicize material from the stolen data.

    Activesocradar.io
  5. Jul 29, 2026

    LeakNet published a follow-up leak-site post accusing NYC Health + Hospitals and the mayor's administration of misleading the Senate about the true scope of the breach, again citing its unverified 12 million record claim.

    Activesocradar.io
  6. Jul 27, 2026

    The extortion group LeakNet posted a preview of the stolen data and claimed its full archive holds 12 million patient records.

    Activescworld.com
  7. Jun 5, 2026

    Patients and staff filed a proposed class action lawsuit over the exposure of their personal and medical data.

    Containedmsn.com
  8. May 18, 2026

    NYC Health + Hospitals confirmed the breach affected at least 1.8 million people and included fingerprint and palm scans.

    Containedthenextweb.com
  9. Mar 24, 2026

    NYC Health + Hospitals posted its first breach notice describing unauthorized network access.

    Containednychealthandhospitals.org

Sources

Related reports