What Is This About?

If you recently received a letter or an email from New York City Health and Hospitals Corporation (“NYC Health + Hospitals”) informing you that your sensitive personal and protected health information was compromised in a data breach, we would like to speak with you about your rights and potential legal remedies. NYC Health + Hospitals recently disclosed that it was the victim of a data breach that exposed individuals’ sensitive personal and protected health information.

What Happened?

NYC Health + Hospitals identified suspicious activity within its network on February 2, 2026. The organization promptly secured its systems and initiated an investigation with the assistance of third-party cybersecurity specialists.

The investigation determined that an unauthorized actor gained access to certain systems between approximately November 25, 2025 and February 11, 2026, during which time files were copied without authorization. NYC Health + Hospitals reports that the incident may be connected to a security compromise involving a third-party vendor.

On March 24, 2026, NYC Health + Hospitals publicly disclosed the incident and began notifying affected individuals while continuing its review to determine the full scope of impacted data and individuals.

Separately, on March 11, 2025, NYC Health + Hospitals confirmed a hacking incident at one of its care management agency partners, the National Association on Drug Abuse Problems (“NADAP”). NADAP provides care coordination services to individuals who receive services under a NYC Health home health program. NYC Health + Hospitals is notifying 5,086 patients in connection to the NADAP breach, which it has said is a separate incident from the breach it confirmed on March 24, 2026.

What Information Was Impacted?

Upon information and belief, the following types of sensitive personal and protected health information may have been compromised:

• • • • • • • • • • Names;
                  • Social Security numbers;
                  • Dates of birth;
                  • Medical information (including diagnoses, treatment plans, medications, and test results);
                  • Health insurance information (including policy and Medicaid/Medicare identifiers);
                  • Biometric data (such as fingerprints and palm prints);
                  • Billing, claims, and payment information;
                  • Financial account and payment card information;
                  • Government-issued identification numbers;
                  • Online account credentials; and
                  • Other sensitive personal data.

What Action Can You Take?

Levi & Korsinsky, LLP is investigating whether affected customers & employees or clients are entitled to compensation. If you worked at New York City Health and Hospitals Corporation (“NYC Health + Hospitals”) or received a notice from them, there is no cost or obligation to participate. Follow the link below to find out about your rights and potential legal remedies available.