Yale New Haven Health Data Breach Exposes Over 5.5 Million Patients To Identity Theft Featured
Victims of the Yale New Haven Health data breach may be eligible for compensation.
A class action lawsuit was recently filed against Yale New Haven Health System (YNHHS), Connecticut’s largest healthcare provider, alleging negligence in its failure to properly secure patient information in accordance with federal and industry standards.
The breach has impacted approximately 5,556,702 individuals across Connecticut, New York, and Rhode Island.
What Happened?
According to information published on the U.S. Department of Health and Human Services’ data breach portal, Yale New Haven Health detected unusual activity affecting its IT systems on March 8, 2025. External cybersecurity experts, including Mandiant, were engaged to assist with the investigation.
The investigation revealed that a criminal hacker accessed YNHHS’s network and exfiltrated sensitive data on the same day. YNHHS reported that while patient care and its electronic medical record system were not impacted, significant amounts of personal information were obtained. The health system began notifying affected individuals on April 14, 2025.
Although Yale New Haven Health has not confirmed whether a ransom demand was made, reports suggest that ransomware may have been involved. Two lawsuits filed in Connecticut District Court allege that YNHHS failed to encrypt sensitive files, implement multi-factor authentication, or adequately train employees on cybersecurity.
What Information Was Involved?
The types of information that may have been compromised vary by individual but include:
- Full names
- Dates of birth
- Postal addresses and email addresses
- Phone numbers
- Race and ethnicity information
- Social Security numbers
- Patient type information
- Medical record numbers
What is Yale New Haven Health Doing to Protect My Identity?
Yale New Haven Health states that it has strengthened its cybersecurity protections and is offering complimentary credit monitoring and identity protection services to individuals whose Social Security numbers were involved in the breach.
What Can Hackers Do With My Information?
Stolen personal and health information can be used to commit identity theft, open fraudulent credit accounts, file false tax returns, or engage in medical identity theft. Cybercriminals frequently target healthcare data due to its high black-market value.
Leaked data can be sold on dark web forums and used to impersonate individuals or submit fraudulent insurance claims. Victims are exposed to a heightened and long-lasting risk of fraud and identity theft and must vigilantly monitor their financial and insurance accounts for suspicious activity.
If you received a notification letter from Yale New Haven Health, it is critical you understand the risks and take steps to protect yourself. A data breach lawyer can help you learn more about your rights and options at no cost to you.
Protect Your Identity. Join the Yale New Haven Health Data Breach Class Action.
The lawsuits allege that Yale New Haven Health System breached its duties under common law and the Federal Trade Commission Act by failing to implement reasonable security measures, comply with federal data-security regulations, and provide timely and adequate notice of the breach.
If you received a notification letter from YNHHS, you may be at permanent risk of identity theft and financial harm.
You may be eligible to join a class action lawsuit to recover compensation for loss of privacy, time spent addressing the breach, out-of-pocket expenses, and other damages.
Please complete the form shown on this page and a data breach attorney will contact you. There is no cost to you.