NYC Health + Hospitals Faces Data Breach Claims Involving Up to 12 Million Patients

A group calling itself LeakNet alleges it stole 11TB of data from NYC Health + Hospitals affecting 12 million people, while the health system has officially confirmed a breach impacting 1.8 million individuals.

Key Points:

• LeakNet claims to possess 11TB of data including medical records, Social Security numbers, and HIV diagnoses from over 12 million people.
• NYC Health + Hospitals officially disclosed a breach affecting 1.8 million patients, with unauthorized access occurring between November 2025 and February 2026.
• The health system attributes the incident to a third-party vendor breach and is currently investigating the full scope of the data loss.
• Federal Senator Bill Cassidy has requested answers from hospital leadership regarding the timeline of detection and notification to federal agencies.

A data extortion group known as LeakNet has published screenshots alleging the theft of 11TB of sensitive information from NYC Health + Hospitals. The group claims the archive contains details for 12 million individuals, including medical histories, government IDs, and financial data. However, these figures have not been independently verified, and database row counts do not necessarily equate to unique affected individuals. The health system has not yet responded to these specific claims.

In contrast, NYC Health + Hospitals officially reported a breach affecting 1.8 million people to the US Department of Health and Human Services. The organization stated that unauthorized actors accessed systems via a third-party vendor from late November 2025 through mid-February 2026. The compromised data includes medical, insurance, biometric, and billing information. The investigation into the extent of the data exfiltration remains ongoing.

The discrepancy between the leaked claims and the official report has drawn attention from federal officials. Senator Bill Cassidy sent a letter to hospital CEO Mitchell Katz asking for clarification on when the breach was detected, which agencies were notified, and whether the organization is meeting all HIPAA reporting requirements. Patients are advised to use the official incident response channels to check for identity protection services rather than accessing any leaked files.

How should healthcare organizations handle discrepancies between official breach reports and unverified claims from data extortion groups?

Learn More: Hack Read

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)