Millions of NYC Health + Hospital patients’ personal data exposed to cybercriminals in data breach, class action lawsuit claims

Millions of NYC Health + Hospitals patients and staff are at lifelong risk of identity theft after a data breach exposed their personal data — including social security numbers, medical records, credit card information and precise geolocation data — to cybercriminals, a class action filed in Manhattan federal court alleges. 

The suit alleges the city’s largest public health system failed to use proper data protection measures on its systems that store patient and staff data, giving hackers easy access to comb through and sell millions of people’s biometric data, like fingerprints, personal identifying documents, like passports and driver licenses, and confidential medical information, like diagnoses, treatment plans, prescriptions, imaging and health insurance details. 

“As a direct and proximate result of [NYC Health + Hospitals’] failure to implement and follow basic security procedures, [patient and staff] private information is now exposed to cybercriminals,” says the suit, filed last month. “[Patients and staff] are now at a significantly increased and certainly impending risk of fraud, identity theft, intrusion of their health privacy, and similar forms of criminal mischief, risks which may last for the rest of their lives.” 

The data breach is believed to have impacted current and former patients, staff, and their family members whose information was in NYC Health + Hospitals’ systems between Nov. 25, 2025, and Feb. 11, 2026. The hospital system said it realized an authorized actor had accessed its system on Feb. 2 and took action to resolve the issue then.

The suit charges NYC Health + Hospitals with negligence and breach of contract, alleging it violated HIPAA standards, Federal Trade Commission guidelines for protecting data and was storing certain personal identifying information it didn’t need to for longer than it should have been.  

NYC Health + Hospitals did not respond to an amNewYork Law request for comment. Its initial public notice of the data breach, posted in March, says it “immediately launched a thorough investigation” when it realized a breach had occurred and has “taken a number of steps” to “protect against future security issues.”

However, the suit takes issue with the hospital system’s response, saying it shouldn’t have taken NYC Health + Hospitals over a month to notify people of the data breach, as it’s imperative that people are able to act immediately after their personal information has been compromised so they can change passwords to avoid identity theft. 

Moreover, those bringing the suit say that because the data breach compromised such sensitive information that’s difficult or impossible to replace – like social security numbers, health insurance information, passports and biometrics – the hospital system needs to be held to account via financial penalties.  

Those impacted by the data breach say they’ve experienced emotional and financial damages due to the stress of having their personal information at risk and having to pay for protective services to curb the potential of their identity being stolen. 

The suit seeks a court order that would force the city’s hospital system to up its data security protocols and to pay financial damages to those impacted, including covering the cost of at least 10 years of credit monitoring services.