Over 5.5 Million Affected in Yale New Haven Health Cyberattack
Yale New Haven Health, Connecticut’s largest healthcare provider, has suffered a major data breach impacting more than 5.5 million individuals, according to a disclosure filed with the U.S. Department of Health and Human Services.
The cyberattack, which occurred in March, reportedly allowed unauthorized actors to access and steal a wide range of personally identifiable information (PII) and medical-related data. The compromised information may include patient names, dates of birth, postal and email addresses, phone numbers, medical record numbers, racial and ethnic data, and even Social Security numbers.
The healthcare system revealed the breach through a notice posted on its website, emphasizing that the type and extent of stolen data vary by individual. A spokesperson told local media that the total number of affected patients could still change as investigations continue.
While Yale New Haven Health declined to provide full details about the cyberattack, spokesperson Dana Marnane suggested that it involved a highly sophisticated operation, potentially linked to ransomware activity. However, the organization did not confirm whether it had communicated with the hackers or received a ransom demand.
So far, no known ransomware group has claimed responsibility, which is not unusual in ongoing ransom negotiations. In many such cases, attackers release the stolen data publicly if their demands are not met.
This incident marks the second major healthcare-related data exposure disclosed this week. Earlier, Blue Shield of California acknowledged sharing sensitive patient information with Google over several years, affecting 4.7 million people.
As investigations continue, the Yale New Haven Health breach underscores growing cybersecurity vulnerabilities within the U.S. healthcare sector — a frequent target for data extortion gangs due to the value and sensitivity of medical records.
