NYC Health Hospitals Hit by Data Breach, Exposing Patient Info

Edelson Lechtzin LLP investigates class action lawsuit over unauthorized network access and data theft

Mar. 28, 2026 at 12:22am

Got story updates? Submit your updates here. ›

The New York City Health and Hospitals Corporation, which operates the nation's largest public healthcare system, disclosed a data breach affecting over a million patients. The breach occurred between November 2025 and February 2026, with unauthorized access to sensitive personal data including names, medical records, Social Security numbers, and financial information.

Why it matters

This breach is a major privacy and security incident for one of the country's largest public health providers, potentially exposing vulnerable patients to identity theft and fraud. The investigation by Edelson Lechtzin LLP could lead to a class action lawsuit on behalf of affected individuals seeking compensation and improved data protection measures.

The details

NYC Health + Hospitals discovered the breach on February 2, 2026, finding that certain data was accessed and copied from its computer network without authorization over a three-month period. The accessed files contained sensitive personal information like names, medical records, Social Security numbers, financial data, and online account credentials.

  • The breach occurred between November 25, 2025 and February 11, 2026.
  • NYC Health + Hospitals discovered the breach on February 2, 2026.

The players

NYC Health + Hospitals

The nation's largest public healthcare system, serving over 1 million patients annually through a network of hospitals, long-term care facilities, and clinics.

Edelson Lechtzin LLP

A national class action law firm investigating potential legal claims on behalf of individuals affected by the NYC Health + Hospitals data breach.

Got photos? Submit your photos here. ›

What’s next

Edelson Lechtzin LLP is actively investigating a potential class action lawsuit against NYC Health + Hospitals on behalf of affected individuals. The law firm is encouraging anyone who received a data breach notification to contact them for a free case evaluation.

The takeaway

This breach highlights the vulnerability of sensitive patient data held by large healthcare providers, and the importance of robust cybersecurity measures to protect against unauthorized access and data theft. The class action investigation could lead to compensation for affected patients and push for improved data protection standards.