NYC Health + Hospitals — the largest public health system in the United States — has disclosed that hackers stole the personal, medical, and biometric data of at least 1.8 million people during a months-long breach. It ranks among the largest healthcare breaches reported in 2026.
What happened
An unauthorized actor had access to NYC Health + Hospitals systems from roughly November 25, 2025 to February 11, 2026, copying files throughout that window. The system detected the intrusion on February 2 and secured its network. NYC Health + Hospitals says the breach may have originated through an unnamed third-party vendor — the same soft entry point behind a long run of recent healthcare hacks.
What was taken
The exposed data is unusually broad: health insurance and policy details, medical information including diagnoses, medications, test results and imaging, billing and payment records, Social Security numbers, passports, driver's licenses, and precise geolocation data. And then the part that sets this breach apart — fingerprints and palm prints.
Why the biometrics matter
Most of what was stolen here is recoverable in the bureaucratic sense. A Social Security number can be monitored; a driver's license can be reissued; a credit file can be frozen. A fingerprint cannot. Biometric identifiers are the one category of personal data a person carries for life and can never rotate. Once a fingerprint or palm print sits in a criminal database, it is there permanently — which makes this the rare breach whose damage compounds rather than fades.
It also raises the question NYC Health + Hospitals has not yet answered: why the system was storing palm prints at all. Biometric retention is supposed to clear a higher bar than ordinary records precisely because the data is irreplaceable. The breach is a reminder — alongside cases like the Hims & Hers hack earlier this year — that healthcare remains the most-targeted sector for data theft, and that the weakest link is increasingly not the hospital's own network but a vendor several steps removed from it.
Comments