NYC Health + Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people

NYC Health + Hospitals disclosed a months-long cyberattack tied to a third-party vendor breach that exposed the records of at least 1.8 million individuals, including medical histories, insurance and billing data, government IDs (SSNs, passports, driver’s licenses), precise geolocation metadata from uploaded ID photos, and biometric information such as fingerprints and palm prints; the intruders had network access from November 2025 until detection in February 2026, and the organization has not publicly confirmed ransom demands or the full scope of affected populations.