Contained High impact Data breach Checked 1d ago

NYC hospital breach exposes 1.8 million people

Hackers copied files from NYC Health + Hospitals after getting in through an unnamed vendor. The health system confirmed that at least 1.8 million people were affected. LeakNet's later claim of more than 12 million people remains unverified. A proposed class action lawsuit filed by a former employee and patient was reported in late August 2026, seeking long-term court oversight of the health system's cybersecurity.

Started
Nov 25, 2025
Latest activity
Aug 26, 2026
Attributed to
LeakNetConfirmed
Where
United States
Sectors
Healthcare
Scale
New York City's public hospital system

Current status

No credible reporting or official statement dated after August 26, 2026 was found; the incident remains contained.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Who is behind it

LeakNet claimed responsibility and published data samples, but NYC Health + Hospitals has not verified the group's role.

Impact

Files containing medical, insurance, biometric, financial and identity data were copied. At least 1.8 million people are confirmed affected, with no reported hospital outage. A lawsuit reported August 26, 2026 describes the intrusion as lasting about 11 weeks and says exposed records included sensitive details such as HIV diagnoses, abortions, suicide attempts, psychiatric care and sexual assault records.

What to do

Affected people should use the health system's incident site or response line to check whether they qualify for two years of identity protection.

Timeline

  1. Aug 26, 2026

    A former employee and patient filed a proposed class action against NYC Health + Hospitals, seeking a decade of court-ordered cybersecurity oversight and describing the intrusion as an 11-week attack that exposed sensitive medical records.

    Containedlaw.com
  2. Jul 27, 2026

    LeakNet published samples and claimed it held data linked to more than 12 million people.

    hackread.com
  3. Jun 4, 2026

    The US Senate health committee requested details about detection, notifications and further security work.

    help.senate.gov
  4. May 18, 2026

    Reporting based on the health system's notice put the confirmed affected population at 1.8 million people.

    Containedthenextweb.com
  5. Mar 26, 2026

    The health system disclosed the breach and said personal and medical information may have been copied.

    Containednychealthandhospitals.org
  6. Feb 11, 2026

    The last known unauthorized access to the affected systems occurred.

    Containednychealthandhospitals.org
  7. Feb 2, 2026

    NYC Health + Hospitals detected suspicious activity while the unauthorized access was continuing.

    Activenychealthandhospitals.org
  8. Nov 25, 2025

    The unauthorized party began accessing systems through an unnamed third-party vendor.

    Activenychealthandhospitals.org

Sources

Related reports