A data-extortion operation using the name LeakNet claims it stole an 11TB archive from NYC Health + Hospitals (NYCHH) containing information linked to more than 12 million people. The figure has not been confirmed by the health system, regulators, or an independent forensic review.
LeakNet published a preview on July 27 containing screenshots of databases, medical spreadsheets, internal messages, and what it described as a complete directory listing for the stolen archive. The group threatened to publish the remaining material in a later release.
As seen by Hackread.com, several screenshots contain visible patient names, addresses, telephone numbers, Social Security numbers, dates of birth, and medical information.
Other images appear to show mental health diagnoses, HIV records, cancer-related appointments, and fingerprint documents bearing NYC Health + Hospitals branding. Hackread.com is not reproducing any patient-identifying details.
12 Million Figure
Although the preview contains credible-looking samples, screenshots cannot establish where every file originated or whether the archive contains 12 million different people. Database rows can represent appointments, diagnoses, transactions, or repeated entries for the same patient, so row totals cannot be treated automatically as a count of affected individuals.
LeakNet also alleged that NYC Health + Hospitals leadership knew on February 2 that at least 12 million people were affected. One supplied screenshot shows an internal service-desk notice from that date telling staff that some Windows users were seeing a data-breach message. Another image shows an extortion notice claiming to have more than 12 million victims and over 11TB of exposed data.
Neither image independently proves that Chief Executive Officer Mitchell Katz knew the 12 million estimate on February 2. The material supplied for this report also does not include a response to Congress in which NYC Health + Hospitals stated that only 1.8 million people were affected.
It is now up to NYC Health + Hospitals to respond to these claims and confirm or deny them.
Confirmed Breach Affected at Least 1.8 Million People
NYC Health + Hospitals disclosed the incident on March 24 after detecting suspicious network activity on February 2. Its investigation found that an unauthorized party accessed systems from approximately November 25, 2025, through February 11, 2026, and copied files.
The health system said the affected information varied by person and could include medical, insurance, biometric, billing and payment data, Social Security numbers, government identification, financial information and online account credentials. It later reported 1.8 million affected people to the US Department of Health and Human Services.
NYC Health + Hospitals said the incident appeared to stem from a breach at an unnamed third-party vendor. Its review of the copied files remained ongoing, and the organization said it would update its public notice if material new information was confirmed.
Senator Sought Answers in June 2026
Senate HELP Committee Chairman Bill Cassidy sent Katz a letter (PDF) on June 4 and copied New York City Mayor Zohran Mamdani. Cassidy asked when the health system detected the incident, which federal agencies it notified, how it was identifying additional exposed information, and whether it would provide reporting beyond HIPAA requirements. The inquiry was also reported by the New York Post.
Cassidy requested answers by June 18, but his letter did not accuse the organization of hiding a 12 million-person breach. It referred to information then publicly available and noted that the health system treats more than one million patients each year.
LeakNet’s Full Blog Post in Screenshots
What’s Next?
For now, the confirmed count remains 1.8 million. LeakNet’s 12 million claim, the alleged 11TB archive, and accusations that executives knowingly underreported the breach require independent confirmation. NYC Health + Hospitals has not publicly addressed the July 27 LeakNet post.
Patients and former employees can use the health system’s official incident website or response line to check eligibility for two years of identity-protection services. Downloading the leaked files is unsafe and causes further exposure for patients whose information may already have been stolen.
