In Brief
- NYC Health + Hospitals disclosed a breach affecting 1.8 million people that exposed fingerprints, palm prints, medical records, Social Security numbers, and precise geolocation data
- Hackers had access from November 2025 to February 2026 — over two months before detection — through a compromised third-party vendor
- Unlike stolen passwords or Social Security numbers, biometric data cannot be changed, making this breach permanently irreversible for those affected
The largest public healthcare system in the United States just disclosed one of the most damaging data breaches of 2026 — and the stolen data cannot be replaced. NYC Health + Hospitals reported to HHS that hackers stole personal data, medical records, and biometric information from at least 1.8 million people.
The attackers gained access through a third-party vendor on approximately November 25, 2025, and remained inside the network until detection on February 2, 2026. That is more than two months of uninterrupted access. During that window, they copied files containing health insurance details, diagnoses, medications, billing data, Social Security numbers, passport and driver’s license numbers, and biometric data including fingerprints and palm prints.
Per Biometric Update, the breach notice also disclosed that precise geolocation data was taken, likely from metadata embedded in photographs of identity documents uploaded by users. NYCHHC did not explain why it was storing biometric data, though employee onboarding for criminal background checks is the most likely reason.
Why Fingerprints Change Everything
A stolen Social Security number can be replaced with a new one. A compromised password can be changed. A fingerprint cannot. Once biometric data is in the hands of attackers, the individuals affected carry that vulnerability for life, with no mechanism for revocation. As TNW reported, this is what distinguishes the breach from the steady drumbeat of healthcare data incidents. The permanence of biometric identifiers creates long-term exposure that no credit monitoring service can remediate.
NYCHHC operates 11 acute care hospitals, five skilled nursing facilities, and more than 70 community-based clinics across New York City’s five boroughs. The population it serves is disproportionately low-income, immigrant, and medically underserved — groups that face higher barriers to responding to identity theft and fraud — a pattern also seen in the Sandhills Medical ransomware breach affecting 170,000 patients. NYCHHC declined to name the third-party vendor involved. Government-affiliated entities have been a recurring target — CISA’s own contractor exposed AWS GovCloud keys on GitHub in a separate incident reported the same month this breach was publicly disclosed.
FAQ
What data was stolen?
Health insurance details, medical records, diagnoses, medications, billing data, Social Security numbers, passport and driver’s license numbers, fingerprints, palm prints, and precise geolocation data.
How many people were affected?
At least 1.8 million people, including current and former patients, employees, and individuals whose data was stored in compromised systems.
How did the breach happen?
Hackers gained access through a compromised third-party vendor on approximately November 25, 2025. The breach was detected on February 2, 2026.