Information for 5.5 million patients exposed by major healthcare data breach

Healthcare seems to be the favorite target of attackers this year. It's been only four months, and we've already seen some of the biggest data breaches in the sector. Recently, news about the Blue Shield of California data breach came to light, leaking the personal data of 4.7 million people.

But if that wasn’t enough, Connecticut’s largest healthcare system, Yale New Haven Health, has now revealed that a data breach affected more than 5.5 million people.

The information leaked included patient names, dates of birth, postal and email addresses, phone numbers and more.

Join the FREE CyberGuy Report: Get my expert tech tips, critical security alerts, and exclusive deals — plus instant access to my free Ultimate Scam Survival Guide when you sign up!

Illustration of a hacker at work. (Kurt "CyberGuy" Knutsson)

What you need to know

According to a legally mandated disclosure with the U.S. Department of Health and Human Services, Yale New Haven Health experienced a cyberattack on March 8 that allowed malicious hackers to obtain copies of patients' personally identifiable information as well as some healthcare-related data.

Yale New Haven Health is a nonprofit healthcare system based in New Haven, Connecticut. It includes five acute-care hospitals, a medical foundation, and a network of outpatient facilities and multispecialty centers across Connecticut, New York and Rhode Island.

WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

In a notice posted on its website, the healthcare system said the stolen data varied by individual but could include names, dates of birth, postal and email addresses, phone numbers, race and ethnicity information, Social Security numbers, types of patients and medical record numbers. Reportedly, the number of affected individuals may still change as investigations continue. Importantly, electronic medical record systems and treatment information were not accessed, and no financial account, payment or employee HR information was involved.

This is not the first time healthcare systems have been in the crosshairs of cybercriminals. In recent years, attacks on institutions like UnitedHealth and Ascension Health have led to months of operational disruption, massive financial costs and prolonged investigations.

Illustration of a doctor looking at data on a phone. (Kurt "CyberGuy" Knutsson)

DOUBLECLICKJACKING HACK TURNS DOUBLE-CLICKS INTO ACCOUNT TAKEOVER

What Yale New Haven Health is doing

Yale New Haven Health brought in cybersecurity firm Mandiant to assist with the investigation and said a rapid response helped contain the incident and prevent any disruption to patient care. The organization noted that it regularly updates and strengthens its systems to protect sensitive data and will continue those efforts. Notification letters began going out to affected individuals on April 14, and complimentary credit monitoring and identity theft protection services have been offered to those whose Social Security numbers were compromised.

The breach could have serious consequences for those impacted. The stolen data includes highly sensitive information that can be used for identity theft, financial fraud, phishing attacks or targeted scams. Healthcare data is especially valuable on the black market because it can be exploited for long periods without easy detection. Even if Social Security numbers or medical information aren’t misused right away, the long-term risk for affected individuals remains significant.

We reached out to Yale New Haven Health (YNHHS), and a health system spokesperson said in part:

"We take our responsibility to safeguard patient information incredibly seriously, and we regret any concern this incident may have caused. We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future. For more information on this incident, patients may visit YNHHS’ website at ynhhs.org or call our dedicated, toll-free call center at 1-855-549-2678, Monday through Friday, between 9:00 am and 9:00 pm Eastern Time, excluding major U.S. holidays."

GET FOX BUSINESS ON THE GO BY CLICKING HERE

A healthcare employee working on a laptop. (Kurt "CyberGuy" Knutsson)

MALWARE EXPOSES 3.9 BILLION PASSWORDS IN HUGE CYBERSECURITY THREAT

5 ways you can stay safe from insurance data breach

If your information was part of the Yale New Haven Health breach or any similar one, it’s worth taking a few steps to protect yourself.

1. Consider identity theft protection services: Since the Yale New Haven Health data breach exposed personal and financial information, it’s crucial to stay proactive against identity theft. Identity theft protection services offer continuous monitoring of your credit reports, social security number, and even the dark web to detect if your information is being misused. These services send you real-time alerts about suspicious activity, such as new credit inquiries or attempts to open accounts in your name, helping you act quickly before serious damage occurs. Beyond monitoring, many identity theft protection companies provide dedicated recovery specialists who assist you in resolving fraud issues, disputing unauthorized charges and restoring your identity if it’s compromised. See my tips and best picks on how to protect yourself from identity theft.

2. Use personal data removal services: The Yale New Haven Health data breach leaks loads of information about you, and all this could end up in the public domain, which essentially gives anyone an opportunity to scam you.

One proactive step is to consider personal data removal services, which specialize in continuously monitoring and removing your information from various online databases and websites. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here.

3. Have strong antivirus software: Yale New Haven Health hackers have people’s email addresses and full names, which makes it easy for them to send you a phishing link that installs malware and steals all your data. These messages are socially engineered to catch them, and catching them is nearly impossible if you’re not careful. However, you’re not without defenses..

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices

4. Enable two-factor authentication: While passwords weren’t part of the data breach, you still need to enable two-factor authentication (2FA). It gives you an extra layer of security on all your important accounts, including email, banking and social media. 2FA requires you to provide a second piece of information, such as a code sent to your phone, in addition to your password when logging in. This makes it significantly harder for hackers to access your accounts, even if they have your password. Enabling 2FA can greatly reduce the risk of unauthorized access and protect your sensitive data.

5. Be wary of mailbox communications: Bad actors may also try to scam you through snail mail. The data leak gives them access to your address. They may impersonate people or brands you know, and use themes that require urgent attention, such as missed deliveries, account suspensions and security alerts.

WINDOWS 10 SECURITY FLAWS LEAVE MILLIONS VULNERABLE

Kurt’s key takeaway

While Yale New Haven has been working with security experts to contain the breach and notify those affected, it is troubling that hackers were able to access the data of 5.5 million individuals before the organization detected the intrusion. The incident highlights a deeper issue, revealing gaps in the security infrastructure that many healthcare institutions are still not adequately addressing.

CLICK HERE TO GET THE FOX NEWS APP

Do you think companies are investing enough in their cybersecurity infrastructure? Let us know by writing us at Cyberguy.com/Contact

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter

Ask Kurt a question or let us know what stories you'd like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Opinion

Deals