Yale New Haven Health (YNHHS) has confirmed that approximately 5.5 million patients had their personal information stolen during a cyberattack that occurred in early March 2025.

YNHHS, Connecticut’s largest nonprofit healthcare network with five hospitals, 360 outpatient locations, and 30,000 health professionals, first reported system disruptions on March 11, though patient care remained unaffected.

Following the incident, YNHHS engaged Mandiant for forensic investigation and system recovery while notifying federal authorities. On April 11, the organization confirmed that unauthorized actors had accessed sensitive patient data.

The compromised information varies by individual but may include:
– Full name
– Date of birth
– Home address
– Telephone number
– Email address
– Race/ethnicity
– Social Security number
– Patient type
– Medical record number

YNHHS emphasized that financial information, medical records, and treatment details were not exposed in the breach.

Beginning April 14, the healthcare network started mailing notification letters to affected patients, offering complimentary credit monitoring and identity protection services to those whose Social Security numbers were compromised.

The U.S. Department of Health and Human Services breach portal has officially recorded 5,556,702 patients affected by this incident. Law firms are already preparing class action lawsuits on behalf of impacted individuals.

The identity of the attackers remains unknown, as no ransomware groups have claimed responsibility for the breach.