Connecticut's largest healthcare network, Yale New Haven Health System (YNHHS), revealed that cybercriminals accessed and stole personal data belonging to over 5.5 million patients during a recent cyberattack.
The breach was discovered on March 8, 2025, when the healthcare provider detected unusual activity in its IT systems. YNHHS immediately launched an investigation with support from cybersecurity firm Mandiant and notified law enforcement authorities.
According to YNHHS officials, the stolen information varied by patient but included personal details such as:
- Full names
- Dates of birth
- Home addresses
- Phone numbers
- Email addresses
- Race/ethnicity data
- Social Security numbers
- Patient identification numbers
- Medical record numbers
The healthcare network emphasized that patient medical records, treatment details, and financial information remained secure. Patient care operations continued uninterrupted throughout the incident, though some internet and application services experienced temporary disruptions during recovery efforts.
Starting April 14, YNHHS began notifying affected patients through mailed letters. The organization is offering free credit monitoring services to individuals whose Social Security numbers were compromised, though no misuse of the stolen data has been reported so far.
YNHHS operates over 360 locations across Connecticut, southeastern New York, and Rhode Island, managing more than 2,400 beds and employing approximately 30,000 healthcare professionals. The organization has established a dedicated call center at 1-855-549-2678 for patients with questions about the incident.
While the technical details of the attack remain undisclosed, no ransomware group has claimed responsibility for the breach. The U.S. Department of Health and Human Services breach portal confirms that 5,556,702 individuals were impacted by this security incident.