Yale New Haven Health Notifying 5.5 Million of March Hack

Connecticut-based Yale New Haven Health System is notifying more than 5.5 million patients that their personal information, including Social Security numbers, could have been stolen in a March hack. The incident, which is among several other recent major health data hacks, ranks as the largest health data breach reported to federal regulator so far this year.

See Also: Top 10 Technical Predictions for 2025

Patient information potentially compromised in the incident varied by individual, but may have included demographic information, such as name, date of birth, address, telephone number, email address, race or ethnicity, as well as Social Security number, patient type and medical record number.

Hackers did not access the health system’s Epic electronic medical record and treatment information, and no financial account or payment information was involved, Yale New Haven Health System said.

“Most applications – including Epic – were not affected and remained fully functioning throughout the incident. We did, initially, face periodic connectivity issues with our internet and phone systems, but that connectivity was restored,” a YNHHS spokesperson told Information Security Media Group.

“While our extensive cybersecurity protocols allowed us to quickly detect and take action to mitigate this incident and minimize impacts on patient care, we are continually reviewing and updating our systems to protect the data we maintain,” the spokesperson said.

YNHHS said in its breach notice that the hacking incident was discovered on March 8, when the entity identified “unusual activity” affecting its IT systems.

“We immediately took steps to contain the incident and began an investigation, which included assistance from external cybersecurity experts,” YNHHS said in its breach notice, adding that the entity notified law enforcement.

YNHHS’ investigation determined that an unauthorized third-party gained access to its network and on March 8 obtained copies of certain data. “At no point did this incident impact our ability to provide patient care,” YNHHS said.

YNHHS is offering complimentary credit monitoring and identity protection services to individuals whose Social Security number was affected. The health system said that, to date, it is not aware of any patient information being used for identity theft or fraud.

YNHHS declined ISMG’s request for additional details, including whether the incident involved ransomware encryption of any IT systems or data, and whether a ransom was demanded or paid.

“We are cooperating with law enforcement and cannot comment on certain details, given the ongoing investigation. I can share that it seems that this was a sophisticated attack likely executed by an individual or group that has a pattern of these types of incidents,” the YNHHS spokesperson said.

As of Thursday, YNHHS already faced at least five proposed federal class action lawsuits related to the hacking incident, alleging negligence by the health system in failing to adequately safeguard plaintiffs’ and class members’ personal identifiable information and protected health information.

YNHHS, which operates eight hospitals and other medical care facilities, is Connecticut’s second-largest employer – with 31,000 workers – declined to comment on the pending lawsuits.

Other Recent Hacks

The YNHHS hack joins several other large incidents added this week to the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website, which lists major health data breaches affecting 500 or more individuals.

That includes an email hack reported by Onsite Mammography, which does business as Onsite Women’s Health, which affected 357,265 individuals. As of Thursday, that incident ranked as the eighth-largest health breach posted on the HHS’ Office for Civil Rights’ breach reporting website.

Massachusetts-based Onsite describes itself as a national service firm that works with healthcare providers to support imaging services offered to patients. The company in its breach notice said the hacking incident discovered in October 2024 affected one employee’s email account, and did involve access to any other systems on Onsite’s IT network.

“According to the investigation, an unauthorized actor gained access to the individual’s email account for a brief window of time,” Onsite said. “Due to the nature of some of the emails in this employee’s inbox, we engaged the services of an outside data analytics vendor that conducted a comprehensive review of the impacted files to determine whether any PHI was involved.”

Protected health information contained in the compromised email account included patient name and other information that Onsite did not specify in its breach notice or sample breach letter provider to regulators. The company is offering affected patients complimentary credit and identity monitoring.

An attorney representing Onsite in its breach report did not immediately respond to ISMG’s request for additional details about the breach.

Besides the YNHHS and Onsite breaches, also added to the HHS OCR website this week is a hacking incident reported on April 14 by Wisconsin-based Bell Ambulance as affecting 114,000 people. The company said the incident, which was discovered in February, potentially compromised data includes patient date of birth, Social Security number, driver’s license number, financial account information, medical information and health insurance information.