An information-extortion operation utilizing the identify LeakNet claims it stole an 11TB archive from NYC Well being + Hospitals (NYCHH) containing data linked to greater than 12 million individuals. The determine has not been confirmed by the well being system, regulators, or an impartial forensic overview.
LeakNet revealed a preview on July 27 containing screenshots of databases, medical spreadsheets, inner messages, and what it described as a whole listing itemizing for the stolen archive. The group threatened to publish the remaining materials in a later launch.
As seen by Hackread.com, a number of screenshots include seen affected person names, addresses, phone numbers, Social Safety numbers, dates of start, and medical data.
Different photographs seem to point out psychological well being diagnoses, HIV information, cancer-related appointments, and fingerprint paperwork bearing NYC Well being + Hospitals branding. Hackread.com just isn’t reproducing any patient-identifying particulars.
12 Million Determine
Though the preview accommodates credible-looking samples, screenshots can’t set up the place each file originated or whether or not the archive accommodates 12 million completely different individuals. Database rows can signify appointments, diagnoses, transactions, or repeated entries for a similar affected person, so row totals can’t be handled routinely as a rely of affected people.
LeakNet additionally alleged that NYC Well being + Hospitals management knew on February 2 that at the very least 12 million individuals had been affected. One provided screenshot exhibits an inner service-desk discover from that date telling workers that some Home windows customers had been seeing a data-breach message. One other picture exhibits an extortion discover claiming to have greater than 12 million victims and over 11TB of uncovered information.
Neither picture independently proves that Chief Government Officer Mitchell Katz knew the 12 million estimate on February 2. The fabric provided for this report additionally doesn’t embrace a response to Congress wherein NYC Well being + Hospitals said that just one.8 million individuals had been affected.
It’s now as much as NYC Well being + Hospitals to reply to these claims and ensure or deny them.
Confirmed Breach Affected at Least 1.8 Million Individuals
NYC Well being + Hospitals disclosed the incident on March 24 after detecting suspicious community exercise on February 2. Its investigation discovered that an unauthorized occasion accessed methods from roughly November 25, 2025, by way of February 11, 2026, and copied recordsdata.
The well being system mentioned the affected data various by particular person and will embrace medical, insurance coverage, biometric, billing and cost information, Social Safety numbers, authorities identification, monetary data and on-line account credentials. It later reported 1.8 million affected individuals to the US Division of Well being and Human Providers.
NYC Well being + Hospitals mentioned the incident appeared to stem from a breach at an unnamed third-party vendor. Its overview of the copied recordsdata remained ongoing, and the group mentioned it could replace its public discover if materials new data was confirmed.
Senator Sought Solutions in June 2026
Senate HELP Committee Chairman Invoice Cassidy despatched Katz a letter (PDF) on June 4 and copied New York Metropolis Mayor Zohran Mamdani. Cassidy requested when the well being system detected the incident, which federal companies it notified, the way it was figuring out further uncovered data, and whether or not it could present reporting past HIPAA necessities. The inquiry was additionally reported by the New York Put up.
Cassidy requested solutions by June 18, however his letter didn’t accuse the group of hiding a 12 million-person breach. It referred to data then publicly out there and famous that the well being system treats a couple of million sufferers every year.
LeakNet’s Full Weblog Put up in Screenshots
What’s Subsequent?
For now, the confirmed rely stays 1.8 million. LeakNet’s 12 million declare, the alleged 11TB archive, and accusations that executives knowingly underreported the breach require impartial affirmation. NYC Well being + Hospitals has not publicly addressed the July 27 LeakNet put up.
Sufferers and former staff can use the well being system’s official incident web site or response line to verify eligibility for 2 years of identity-protection providers. Downloading the leaked recordsdata is unsafe and causes additional publicity for sufferers whose data might have already got been stolen.
