2026 NYC Health + Hospitals — third-party vendor breach; PHI, biometrics, 1.8M+ (Nov 2025–Feb 2026)

Verified NYC Health + Hospitals disclosure — HHS filing March 24, 2026; public notice May 2026. The largest U.S. public health system reported that an unauthorized actor accessed certain systems between approximately November 25, 2025 and February 11, 2026 (suspicious activity detected February 2, 2026) via compromise of an unnamed third-party vendor, then copied files. At least 1.8 million people were affected. Exposed categories vary by individual and include insurance/policy data, diagnoses, medications, tests, medical imagery, billing and claims, Social Security numbers, passports, driver’s licenses, geolocation metadata tied to identity-document uploads, and biometric fingerprints and palm prints (often collected for employee background checks). TechCrunch and Malwarebytes emphasized that raw biometrics cannot be rotated like passwords. NYCHHC stated its own network was secured after discovery. Distinct from the separate March 2026 Solventum HIS business-associate breach affecting a NYC H+H patient subset (~59k). July 2026 update: LeakNet separately claimed an 11TB / ~12M-person archive (unverified) — see catalog row nyc-health-hospitals-leaknet-claim2026; confirmed public count remains ~1.8M unless/until NYCHH revises.