New York City Health and Hospitals, the largest public healthcare system in the United States, disclosed a major data breach that compromised the personal information of at least 1.8 million patients.

The cyberattack resulted in the theft of sensitive data including medical records, payment information, and biometric scans such as fingerprints. The breach represents one of the largest healthcare data security incidents recorded in 2024.

NYC Health and Hospitals operates 11 acute care hospitals and serves as the primary safety net healthcare provider for New York City residents. The system provides medical services to millions of patients across the five boroughs, making the scope of the breach particularly significant.

The healthcare system has not disclosed specific details about when the breach occurred or how long hackers had access to patient data. The investigation into the incident is ongoing, and affected patients are being notified according to standard data breach protocols.

Healthcare organizations have increasingly become targets for cybercriminals due to the valuable nature of medical data and patient information. The theft of biometric data like fingerprints raises additional security concerns, as this type of information cannot be changed like passwords or credit card numbers.