Yale New Haven Health cyberattack exposes data of 5.5 million
CONNECTICUT, UNITED STATES — Yale New Haven Health has reported a massive data breach affecting 5.5 million patients after an unauthorized third party infiltrated its network in March.
The Connecticut-based health system insists patient care was unaffected, but lawsuits allege negligence in safeguarding sensitive data.
Healthcare cybersecurity failures putting millions at risk
At Yale New Haven Health, a system-wide cybersecurity weakness became apparent through the recent data breach, which targeted protected information, including names, birth dates, Social Security details, and patient medical files.
The healthcare breach makes up the biggest reported incident to HHS as of 2025, which demonstrates why medical records are lucrative targets for hacking operations.
Healthcare institutions experience cyberattacks, which average $11 million to recover from the damages, and this exceeds the global cost average by three times.
Despite assurances that electronic health records (EHR) were untouched, lawsuits accuse Yale New Haven of failing to secure sensitive data, leaving millions exposed to potential identity theft.
Demand for stronger protections amid ransomware threats
Ransomware attacks now account for over 70% of successful healthcare cyberattacks, with Yale New Haven’s breach reflecting a broader crisis.
The Federal Bureau of Investigation (FBI) Internet Crime Complaint Center reports a 9% annual increase in ransomware complaints from 2023, nearly half targeting critical infrastructure like hospitals.
The affected patients of Yale New Haven Hospital consider their credit monitoring services inadequate.
“We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future,” YNHHS said on its website.
Yale New Haven Health alerts its patient base as Connecticut‘s largest healthcare organization struggles against legal examinations.
As cyber threats escalate, experts warn that robust security upgrades, not just damage control, are critical to protecting patient trust.
