Almeida Law Group is investigating a data breach at NYC Health + Hospitals. If you were affected, contact Almeida Law Group.
About NYC Health + Hospitals
NYC Health + Hospitals, officially the New York City Health and Hospitals Corporation, is the largest municipal healthcare delivery system in the United States. Headquartered at 125 Worth Street in Manhattan, it operates 11 acute-care hospitals, community-based health centers, long-term care and rehabilitation facilities, home care services, correctional health services, and the MetroPlus health plan across all five boroughs of New York City. The system employs approximately 45,000 people and serves more than one million New Yorkers annually, functioning as the city’s primary safety-net health system for uninsured and Medicaid patients.
What Happened?
NYC Health + Hospitals was listed in an HHS Office for Civil Rights breach portal report submitted on June 18th, 2026, identifying an unauthorized access/disclosure incident affecting 58,778 individuals. A business associate was noted as present in the filing.
According to the organization’s official breach notice and reporting by TechCrunch, Malwarebytes, and HIPAA Journal, NYC Health + Hospitals detected suspicious activity on February 2nd, 2026. An investigation determined that an unauthorized actor had access to its network from approximately November 25th, 2025 through February 11th, 2026 — roughly 11 weeks of undetected access. The intrusion was attributed to a breach at an unnamed third-party vendor, and files were exfiltrated from the network. The breach was first publicly disclosed on March 24th, 2026. A separate, larger HHS filing covering approximately 1.8 million individuals was submitted around that time. The June 18th, 2026 filing referenced here, listing 58,778 individuals and noting a business associate was present, appears to be a separate or supplemental filing; its exact relationship to the larger incident is not clear from public sources.
Compromised data varies by individual and may include names and contact details; Social Security numbers; driver’s license numbers; passport numbers; other government ID numbers; taxpayer IDs; IRS identity protection PINs; health insurance plan and policy information; insurance company names and member and group ID numbers; Medicaid, Medicare, and other government payor ID numbers; medical record numbers; diagnoses; medications; test results; medical imagery; treatment plans; disability codes; billing, claims, and payment information; bank and credit card data; online account credentials; fingerprint and palm print biometric data; and precise geolocation data.
One law firm investigating the incident described it as an alleged ransomware attack, but NYC Health + Hospitals has not publicly confirmed ransomware and no threat actor has been named. The organization stated that the delay between the breach start in November 2025, its February 2nd, 2026 discovery, and its March 24th, 2026 notification was due to the time needed to review affected data. A class action lawsuit was filed in the U.S. District Court for the Southern District of New York by former patient Deneice O’Connor, alleging negligence and breach of contract for failing to implement adequate data security measures and provide timely notice, with violations of HIPAA standards and FTC guidelines also alleged. Multiple additional law firms have announced class action investigations. Separately, a prior breach at NYC Health + Hospitals’ care management partner NADAP, involving 5,086 patients and stemming from an incident around November 26th, 2025, was disclosed by NYC Health + Hospitals on March 11th, 2026; reporting indicates that incident appears unrelated to the larger network breach.
Key Facts at a Glance
- Company or Organization: NYC Health + Hospitals
- Industry: Healthcare / Public Municipal Hospital System
- Location: 125 Worth Street, Civic Center, Manhattan, New York, NY; operates across all five boroughs of New York City
- Incident type: Unauthorized Access/Disclosure
- Date of consumer notification: March 24th, 2026
- Total persons affected: 58,778 (this filing); approximately 1.8 million (larger related HHS filing)
- Prior breach: Yes — NADAP partner breach affecting 5,086 patients, disclosed March 11th, 2026
- Litigation status: Class action filed in SDNY by Deneice O’Connor; multiple additional law firms investigating
- Source: HHS Office for Civil Rights breach portal report (record ID 1464578): https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf#1464578; NYC Health + Hospitals official notice: https://www.nychealthandhospitals.org/pressrelease/notice-of-data-breach/; TechCrunch: https://techcrunch.com/2026/05/18/nyc-health-and-hospitals-says-hackers-stole-medical-data-and-fingerprints-during-breach-affecting-at-least-1-8-million-people/; HIPAA Journal: https://www.hipaajournal.com/nyc-health-hospitals-data-breach-march-26/
What Should You Do?
If you believe you were affected by this breach, enroll in any identity theft protection services NYC Health + Hospitals has offered and note any enrollment deadline in the notification letter you received. Place a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your credit reports for unfamiliar accounts or inquiries. You can request free annual credit reports at AnnualCreditReport.com. Because health and medical information was involved, review your Explanation of Benefits statements and request copies of your medical records to check for any services you did not receive. Watch for unauthorized charges on your bank and credit card accounts given that financial data was also exposed. If you discover signs of fraud or identity theft, report them at IdentityTheft.gov for step-by-step recovery guidance.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
