Data extortion group claims 12 million patient records stolen from NYC Health + Hospitals

A data-extortion operation known as LeakNet claims to have stolen an 11TB archive from NYC Health + Hospitals (NYCHH) containing information linked to more than 12 million individuals. The health system has not confirmed this figure, nor have regulators or an independent forensic review, as reported by HackRead.

LeakNet published a preview of the alleged stolen data on July 27, including screenshots of databases, medical spreadsheets, and internal messages. The group threatened further releases, with some screenshots appearing to show patient names, addresses, Social Security numbers, and sensitive medical information, including mental health diagnoses and HIV records. While the preview contains credible-looking samples, the exact number of affected individuals is difficult to ascertain from screenshots alone.

NYC Health + Hospitals previously disclosed a breach on March 24, detecting suspicious activity on February 2 and confirming unauthorized access from November 25, 2025, through February 11, 2026. This confirmed breach affected at least 1.8 million people, involving medical, insurance, biometric, and financial data, as well as Social Security numbers. The health system attributed the incident to a breach at an unnamed third-party vendor. Senator Bill Cassidy inquired about the breach in June 2026, seeking details on detection, notification, and ongoing investigations. LeakNet's claim of 12 million affected individuals and an 11TB archive requires independent confirmation, as NYC Health + Hospitals has not publicly addressed the group's recent post.

Source: HackRead