"The biggest issue with biometric data is that it cannot really be reset," said Ross Filipek, CISO at security firm Corsica Technologies.
NYC Health + Hospitals: 1.8 million people flagged
New York City's municipal healthcare system is notifying nearly 1.8 million patients after a hacking incident discovered earlier this year, according to the U.S. Department of Health and Human Services' health data breach reporting site. The affected organization, NYC Health + Hospitals, serves more than 1 million patients annually and operates 70 care locations, including multiple hospitals across the five boroughs.
Third-party vendor at the center; identity undisclosed
In a breach notice published March 24, NYC Health said hackers appeared to have gained access to the organization's systems "due to a security breach at a third-party vendor." The health system first revealed the data breach in March but did not provide further detail identifying the vendor. NYC Health did not immediately respond to ISMG's request for additional details about the breach, including the identity of the vendor at the center of the incident.
Range of exposed data: from insurance IDs to biometrics
The published notices list a broad set of information that may have been compromised. That list includes health insurance information such as Medicaid, Medicare and private policy ID numbers; medical information and billing claims; Social Security numbers; credit and debit card numbers; and biometric data, including fingerprints and palm prints. Security experts quoted in the reporting warned that biometric identifiers carry a unique risk because, unlike passwords, they cannot be changed if stolen.
Separate March incident at care management partner
This is the second hacking-related breach tied to third parties that NYC Health has disclosed so far this year. A March 11 breach notice said NYC Health was notifying 5,086 patients of a hacking incident involving one of its care management agency partners, the National Association on Drug Abuse Programs, which provides care coordination services to individuals who receive services under a NYC Health home health program. A NYC Health spokesman previously told ISMG that the two breaches are separate incidents.
What this means for patients, public health providers, and security teams
- Patients: Those notified face risks the notice highlights explicitly — fraud or medical identity theft — and are being informed that highly sensitive identifiers, including Social Security numbers and biometric data, may have been exposed.
- Public health providers: As a safety-net system that serves large, often vulnerable populations, NYC Health + Hospitals must manage notification obligations and the potential operational and trust impacts of a breach affecting nearly 2 million people.
- Security teams and vendors: The incident underlines the downstream risk of third-party relationships. Security leaders will be watching how remediation, vendor disclosure and third-party controls are handled, especially where immutable biometric data are involved.
Security practitioners quoted in the coverage emphasized both immediate and long-term risks. Ross Filipek noted that while attackers "may not be able to use that information everywhere immediately, it can become more valuable over time as biometric authentication becomes more common across healthcare, financial services and identity systems." He also warned that "when a public health provider is hit at this scale, the ripple effects can be much larger than the organization itself," citing potential impacts on investigations, notifications, trust and operational strain.
The public record available through the HHS breach reporting site confirms the scale reported to affected individuals, but the identity of the implicated vendor and details of how its security was breached remain undisclosed in the notices cited. For now, NYC Health + Hospitals and its affected patients are left to manage the immediate fallout of a breach that combines classical identifiers such as Social Security and payment card numbers with biometric data that cannot be reset.
https://www.govinfosecurity.com/public-nyc-health-system-notifying-18m-hack-a-31726
