NYC Health + Hospitals Hack Exposes Medical and Credit Card Data of 1.8 Million People

NYC Health + Hospitals is the largest public hospital system in the United States and serves a large number of patients across New York City. The breach involved difficult-to-replace sensitive information, including medical records, fingerprints and credit card account data. Beyond the risks of identity theft and financial fraud, the incident highlights healthcare institutions' reliance on third-party supply-chain security.

NYC Health + Hospitals confirmed in 2026 that its systems had been compromised, affecting about 1.8 million people. It was one of the largest U.S. healthcare cybersecurity incidents that year by number of people affected. Preliminary information indicated that the attackers may have exploited a vulnerability in a third-party vendor's system and continued accessing the data for several months.