LeakNet Claims 11TB / 12M-Record Exfiltration from NYC Health + Hospitals — Health System Has Not Confirmed Expanded Scope, Prior Disclosure Was 1.8M

Extortion actor LeakNet published a preview on July 27 alleging possession of an 11TB archive from NYC Health + Hospitals containing data on up to 12 million individuals, including mental health diagnoses, HIV records, biometric data, Social Security numbers, and financial information. NYC Health + Hospitals previously disclosed a confirmed breach affecting 1.8 million individuals from a November 2025–February 2026 intrusion attributed to a third-party vendor compromise; the health system has not publicly addressed the LeakNet claim nor the group's assertion that executive leadership was aware of the larger breach scope by February 2. The expanded claim requires independent forensic confirmation, but samples published in the preview appear credible and the organization has now suffered three distinct data security incidents in 2026.

The expanded claim requires independent forensic confirmation, but samples published in the preview appear credible and the organization has now suffered three distinct data security incidents in 2026.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.