【AI前沿】NYC Health + Hospitals says hackers stole medical data and fingerprints during breach affecting at least 1.8 million people

New York public health provider NYC Health + Hospitals saysa months-long data breachthat allowed hackers to steal personal data, medical records, and fingerprints scans affects at least 1.8 million people.NYCHHC is the largest public health system in the United States and provides healthcare toover a million New Yorkers, the majority of whom are uninsured or receive state healthcare benefits, such as Medicaid.The healthcare system reported the number to the U.S. Department of Health and Human Services, making it one of the largest healthcare-related data breaches of the year so far. Healthcare organizations have been repeatedly targeted by financially motivated cybercriminals in recent years in efforts to steal their vast banks of highly sensitive patients’ personal, medical, and billing information.In a data breach notice on its website, NYCHHC said that it detected a cyberattack on February 2 and secured its network. The hackers had access to its network from November 2025 until February 2026, during which the hackers copied files from its systems.The healthcare system said hackers broke due to a breach at a third-party vendor, which it did not name.NYCHHC said that the exposed data varies by individual and includes patients’ health insurance plan and policy information, medical information (e.g., diagnoses, medications, tests, and imagery), billing, claims, and payment information. Other government-issued identity documents, such as Social Security numbers, passports, and driver’s licenses, were also compromised.The breach notice also says “precise geolocation data” was taken in the breach, suggesting that the user-uploaded photos of their identity documents may have also contained the exact location of where the document was captured.The breach is particularly sensitive because hackers stole biometric information, including fingerprints and palm prints, which affected individuals have for life and cannot replace. NYCHHC did not provide an explanation for storing biometric data. Prospective NYCHHC employees are generally required to enroll their fingerprints for criminal records checks. It’s not yet known if patients’ biometrics were also taken.NYCHHC’s website was briefly offline as of Monday morning. A spokesperson for NYCHHC did not immediately respond to an email from TechCrunch with questions about the cyberattack. TechCrunch asked, among other things, why it took the organization months to detect the breach, and if it has received any communication from the hackers, such as a demand for payment.It’s not clear if NYCHHC can receive email at the time of the website outage.The incident appears to be unrelated to the data breach at National Association on Drug Abuse Problems (NADAP)earlier this year, in which over 5,000 NYCHHC patients had information taken in the cyberattack.In the FBI’s latestannual report on cybercrimecovering 2025, healthcare remained a top target for ransomware attackers — criminals who break into databases, steal a copy of the data while scrambling the victim’s servers, and threaten to publish the stolen data if the victim does not pay the hackers. A ransomware attack on UnitedHealth-owned health tech giant Change Healthcare allowed Russian-linked hackers tosteal the medical and billing information of more than 190 million Americans, believed to be the largest theft of U.S. medical data in history.Topicscyberattack,cybersecurity,data breach,healthcare,new york city,SecurityWhen you purchase through links in our articles,we may earn a small commission. This doesn’t affect our editorial independence.Zack WhittakerSecurity EditorZack Whittaker is the security editor at TechCrunch. He also authors the weekly cybersecurity newsletter,this week in security.He can be reached via encrypted message at zackwhittaker.1337 on Signal. You can also contact him by email, or to verify outreach, [email protected] BioMay 27Athens, GreeceStrictlyVC Athens is up next. Hear unfiltered insights straight from Europe’s tech leaders and connect with the people shaping what’s ahead. Lock in your spot before it’s gone.REGISTER NOWMost PopularUsers turn to jailbreaking their older Kindles as Amazon ends supportLauren ForristalOpenAI launches ChatGPT for personal finance, will let you connect bank accountsIvan MehtaUS orders travelers on Air Force One to throw away gifts, pins, and burner phones after China tripLorenzo Franceschi-BicchieraiWhat happens when AI starts building itself?Russell BrandomOpenAI is reportedly preparing legal action against Apple; it wouldn’t be the first partner to feel burnedConnie LoizosHow to turn off Instagram’s new Instants feature and retract photos you accidentally sharedAisha MalikMusk’s xAI is running nearly 50 gas turbines unchecked at its Mississippi data centerTim De Chant