Millions of NYC Health + Hospital patients’ personal data exposed to cybercriminals in data breach, class action lawsuit claims

A class action lawsuit filed in Manhattan federal court alleges that millions of patients and staff at NYC Health + Hospitals had their personal data exposed to cybercriminals. The suit claims the city's largest public health system failed to use proper data protection measures, allowing hackers access to sensitive information including social security numbers, medical records, credit card information, and precise geolocation data. The data breach is believed to have impacted current and former patients, staff, and their family members between Nov. 25, 2025, and Feb. 11, 2026. The suit charges the hospital system with negligence and breach of contract, alleging it violated HIPAA standards and Federal Trade Commission guidelines. The plaintiffs argue that the hospital system should have notified people of the breach immediately and that the sensitive information compromised, such as social security numbers and biometrics, requires financial penalties. The suit seeks a court order to force the hospital system to improve its data security protocols and to pay financial damages to those impacted, including covering the cost of at least 10 years of credit monitoring services.

(Source：AM New York)