Cyberattack on Yale New Haven Health exposes 5.6M patients
Earlier this month, Yale New Haven Health revealed it has experienced a “data security incident” that resulted in protected personal information being exposed to hackers. While the investigation into the breach is ongoing, a report with the Department of Health and Human Services (HHS) reveals the incident impacted roughly 5.6 million people.
The health system has been mum about the specifics of the data breach; however, an alert it sent out on March 11 detailed the “cybersecurity incident,” discussing how containment measures were deployed once suspicious activity was noticed on its network. Further, while some IT systems experienced downtime, Yale New Haven said its patient portal and electronic health record were not impacted.
While the attack has many of the hallmarks of ransomware, statements from the health system made no mention of any payments or demands. What is for certain—with 5.6 million identified victims—it’s so far the largest healthcare data breach on record with HHS in 2025.
Yale New Haven noted that, on March 8, its investigation found an “unauthorized third party” was able to copy and steal “certain data.” However, the EHR was never breached, meaning the hackers were unable to access patient medical data that would have included information on treatments and diagnoses.
Stolen information, the health system said in an updated statement on April 11, varied from person-to-person but generally included names, dates of birth, addresses, contact information, details on race or ethnicity, Social Security numbers and medical record numbers.
Yale New Haven said it began notifying impacted individuals earlier this month.
“We have begun the process of mailing letters to patients whose information was involved in this incident and providing appropriate resources, including offering complimentary credit monitoring and identity protection services to individuals whose Social Security number was involved,” the health system wrote in a statement.
“Patients are also encouraged to review statements they receive from their healthcare providers and immediately report any inaccuracies to the provider,” it added.
The Connecticut-based health system operates five hospitals totaling 2,681 beds, offering in-patient and outpatient primary and specialty care services.
It’s not clear to what degree Yale New Haven may share a network with other Yale entities and how that factored into the 5.6 million victims. HealthExec reached out for clarity, but a spokesperson declined to provide more information.
Chad is an award-winning writer and editor with over 15 years of experience working in media. He has a decade-long professional background in healthcare, working as a writer and in public relations.