A knowledge-extortion operation utilizing the identify LeakNet claims it stole an 11TB archive from NYC Well being + Hospitals (NYCHH) containing data linked to greater than 12 million folks. The determine has not been confirmed by the well being system, regulators, or an impartial forensic evaluate.
LeakNet printed a preview on July 27 containing screenshots of databases, medical spreadsheets, inner messages, and what it described as an entire listing itemizing for the stolen archive. The group threatened to publish the remaining materials in a later launch.
As seen by Hackread.com, a number of screenshots comprise seen affected person names, addresses, phone numbers, Social Safety numbers, dates of start, and medical data.
Different pictures seem to point out psychological well being diagnoses, HIV data, cancer-related appointments, and fingerprint paperwork bearing NYC Well being + Hospitals branding. Hackread.com will not be reproducing any patient-identifying particulars.
12 Million Determine
Though the preview incorporates credible-looking samples, screenshots can’t set up the place each file originated or whether or not the archive incorporates 12 million completely different folks. Database rows can symbolize appointments, diagnoses, transactions, or repeated entries for a similar affected person, so row totals can’t be handled mechanically as a rely of affected people.
LeakNet additionally alleged that NYC Well being + Hospitals management knew on February 2 that no less than 12 million folks had been affected. One equipped screenshot exhibits an inner service-desk discover from that date telling employees that some Home windows customers had been seeing a data-breach message. One other picture exhibits an extortion discover claiming to have greater than 12 million victims and over 11TB of uncovered information.
Neither picture independently proves that Chief Government Officer Mitchell Katz knew the 12 million estimate on February 2. The fabric equipped for this report additionally doesn’t embody a response to Congress through which NYC Well being + Hospitals said that only one.8 million folks had been affected.
It’s now as much as NYC Well being + Hospitals to reply to these claims and make sure or deny them.
Confirmed Breach Affected at Least 1.8 Million Individuals
NYC Well being + Hospitals disclosed the incident on March 24 after detecting suspicious community exercise on February 2. Its investigation discovered that an unauthorized occasion accessed methods from roughly November 25, 2025, by means of February 11, 2026, and copied information.
The well being system mentioned the affected data different by particular person and will embody medical, insurance coverage, biometric, billing and cost information, Social Safety numbers, authorities identification, monetary data and on-line account credentials. It later reported 1.8 million affected folks to the US Division of Well being and Human Providers.
NYC Well being + Hospitals mentioned the incident appeared to stem from a breach at an unnamed third-party vendor. Its evaluate of the copied information remained ongoing, and the group mentioned it could replace its public discover if materials new data was confirmed.
Senator Sought Solutions in June 2026
Senate HELP Committee Chairman Invoice Cassidy despatched Katz a letter (PDF) on June 4 and copied New York Metropolis Mayor Zohran Mamdani. Cassidy requested when the well being system detected the incident, which federal businesses it notified, the way it was figuring out extra uncovered data, and whether or not it could present reporting past HIPAA necessities. The inquiry was additionally reported by the New York Put up.
Cassidy requested solutions by June 18, however his letter didn’t accuse the group of hiding a 12 million-person breach. It referred to data then publicly obtainable and famous that the well being system treats multiple million sufferers every year.
LeakNet’s Full Weblog Put up in Screenshots
What’s Subsequent?
For now, the confirmed rely stays 1.8 million. LeakNet’s 12 million declare, the alleged 11TB archive, and accusations that executives knowingly underreported the breach require impartial affirmation. NYC Well being + Hospitals has not publicly addressed the July 27 LeakNet publish.
Sufferers and former staff can use the well being system’s official incident web site or response line to test eligibility for 2 years of identity-protection providers. Downloading the leaked information is unsafe and causes additional publicity for sufferers whose data could have already got been stolen.
