Yale New Haven Health breach exposed data on nearly 5.6 million patients

Yale New Haven Health System, Connecticut's largest healthcare provider, said it detected unusual activity on its IT systems on 8 March 2025 and later determined that an unauthorised third party had accessed its network and copied patient data.

The health system reported the breach to the US Department of Health and Human Services Office for Civil Rights in April 2025, putting the number of affected individuals at close to 5.6 million. At the time it was the largest healthcare breach filed with federal regulators in 2025.

Exposed information varied by patient and included names, dates of birth, telephone numbers, home addresses, email addresses, race or ethnicity, patient type, medical record numbers and, for some individuals, Social Security numbers. Yale New Haven said the attackers did not reach its electronic medical record system or patient portal, and that treatment information, financial account details and payment card data were not involved.

The system engaged external cybersecurity specialists to investigate and said its response contained the incident without disrupting patient care, with the electronic record system and patient portal operating normally through March. Notification letters to affected individuals began going out in April 2025. Yale New Haven, which runs five hospitals and more than 360 outpatient locations, said it was continuing to update and enhance its systems.