Hackers Broke Into NYC's Hospital System for 3 Months and Stole Your Fingerprints

For nearly three months, hackers roamed undetected inside the largest public hospital system in the U.S. By the time the intrusion was discovered, the thieves had walked away with a haul that can never be changed or reset: the finger and palm prints of patients.

NYC Health + Hospitals (NYC H+H) disclosed this week that hackers accessed sensitive patient and employee data through a third-party vendor between November 25, 2025, and February 11, 2026, affecting at least 1.8 million people.^[1] The system serves more than a million patients across 70 locations in New York City's five boroughs.^[2]

The breach exposed medical records, Social Security numbers, financial details, and biometric identifiers. Unlike a password or a credit card number, your fingerprints can’t be canceled or reissued.

Here's what happened, why this breach is different from most, and what to do if you may be affected.

What hackers stole, and why some of it can never be replaced

The data stolen during the nearly 11-week compromise varies by individual but includes:

• Medical records, diagnoses, and treatment information
• Health insurance details
• Billing, financial accounts, and payment information
• Social Security numbers
• Passport and driver's license numbers
• Online account credentials
• Biometric data, including fingerprints and palm prints

NYC Health + Hospitals said anyone who was a patient or employee between 2020 and February 2, 2026, could be affected, a window spanning more than five years.

Medical records are among the most valuable targets in cybercrime because they consolidate personal, financial, and insurance details in a single file. Unlike a stolen credit card, which can be quickly canceled, medical histories and biometric identifiers can’t be replaced once exposed.

The breach was first detected on February 2, 2026, and officially reported to the U.S. Department of Health and Human Services on March 24, according to HIPAA Journal. The third-party vendor involved has not been publicly identified.

Why biometric theft is a different kind of threat

The fingerprint data is what makes this breach particularly concerning.

Passwords can be changed, and cards can be replaced. Even compromised Social Security numbers can sometimes be flagged by fraud monitoring systems. But you can't just change your fingers.

"The biggest issue with biometric data is that it cannot really be reset," said Ross Filipek, CISO of Corsica Technologies. "If a fingerprint is stolen, that identifier is tied to a person permanently."

The sheer length of the breach is also alarming. Hackers maintained access for nearly three months before detection, giving them ample time to search, copy, and potentially distribute sensitive records.

This breach fits a pattern that's been building. Recent AAC coverage has documented similar incidents — a breach involving Canvas student data and the Palantir/NHS patient data controversy — reflecting how third-party vendor access to sensitive institutional data remains one of the most exploitable gaps in cybersecurity.

According to a survey by All About Cookies, 50% of Americans say they feel desensitized to data breach alerts. Even as 60% say they're specifically concerned about their medical history being exposed, which is precisely what's at risk here.

The downstream financial stakes are significant, too. AAC research found that 14% of Americans have personally experienced identity theft, with the average victim losing $3,312.66. Data breaches are the leading cause of online identity theft, accounting for 38% of cases.

What to do right now

If you were a patient or employee at any NYC Health + Hospitals location between 2020 and early February 2026, treat yourself as potentially affected — even before a notification letter arrives. Research shows that only 46% of breach victims ever check whether their data was included. Here's where to start:

1. Confirm whether you're affected: call (844) 403-4518 or watch for a mailed notification letter from NYC H+H.
2. Enroll in the 24 months of free credit monitoring NYC H+H is offering to affected individuals. This service comes at no cost to you.
3. Place a fraud alert or credit freeze at all three bureaus: Equifax, Experian, and TransUnion. A freeze is free and prevents new accounts from being opened in your name.
4. Review your health insurance Explanation of Benefits (EOBs) for any unfamiliar charges or procedures. Medical identity theft, in which someone uses your information to obtain care, prescriptions, or insurance reimbursements, is among the most common and hardest-to-detect consequences of a healthcare breach.
5. Consider an identity theft protection service for ongoing monitoring. AAC research found that 71% of identity theft victims with monitoring in place were alerted, compared to just 20% of those without it. Services like Aura and LifeLock offer dark web monitoring, data removal, and identity theft insurance.
6. Run a free dark web scan to check whether your credentials have already surfaced online.
7. If you use fingerprint authentication to access your phone, financial apps, or other sensitive accounts, review those settings and add a secondary layer, like a PIN or strong password, as a backup.

Bottom line

NYC H+H is doing the right things post-breach: being transparent about the scope of the incident, notifying affected individuals, and offering two years of free credit monitoring. That matters.

But the biometric data is the part that can't be undone. Your fingerprints are a permanent identifier, and once they're in the wrong hands, the exposure doesn't expire. Ongoing monitoring isn't optional after a breach like this — it's the most practical tool available for catching misuse before it compounds.

If you've ever been a patient at an NYC public hospital, now is the time to review your identity theft protection and data removal service options.

You can't change what was taken. But knowing how to tell if someone has stolen your identity and catching it early makes all the difference.