Yale New Haven Health System ynhhs.org Yale New Haven Health System data breach: what happened and what to do
Yale New Haven Health System found unusual IT activity on March 8, 2025 and reported that 5,556,702 people were affected. Names, dates of birth, addresses, Social Security numbers and medical record numbers may be exposed.
View all 13,115 breaches- Breach date
- 8 Mar 2025
- Made public
- 11 Apr 2025
- Affected
- 5,556,702
- Data exposed
- Names, Dates of birth, Physical addresses, Social security numbers, Medical record numbers
- Last updated
What happened
Yale New Haven Health System (YNHHS), a large Connecticut hospital network, identified unusual activity on its IT systems on March 8, 2025. It said an intruder copied data the same day. It brought in Mandiant to investigate and began mailing notification letters in mid-April 2025.
In its report to the U.S. Department of Health and Human Services, YNHHS listed 5,556,702 people. That made it the largest health data breach reported to the regulator in 2025 at the time. No ransomware group had publicly claimed it in the early coverage.
What was exposed
Depending on the person, the data may include names, dates of birth, contact details, race or ethnicity, Social Security numbers, patient type and medical record numbers. Reporting says financial information, full medical records and treatment details weren't part of it.
What it means for you
Social Security numbers with names and birth dates are the core of identity theft, and they never expire. Address and medical record number details also make scams that pose as the hospital more believable.
The company's response
YNHHS notified HHS, affected people and the media, used substitute notice, and added administrative, technical and security safeguards. Multiple class actions followed.
What to do if you were in it
- 1
Freeze your credit
A freeze at Equifax, Experian and TransUnion stops anyone opening new credit in your name. It's free, takes a few minutes per bureau and you can lift it when you need to borrow.
- 2
Take the free monitoring if you were offered it
If Yale New Haven Health sent you a letter with an enrollment code, use it before the deadline. It adds alerts on top of a freeze, it doesn't replace one.
- 3
Read your statements and explanations of benefits
Look for accounts, loans, claims or tax filings you don't recognize, and report them to the lender, insurer or the IRS right away.
- 4
Expect phishing that mentions the breach
Scammers pose as Yale New Haven Health or as a credit monitoring service. Don't click links in unexpected texts or emails, and call the number on the letter or the official website instead.
- 5
Check whether your email or phone is in this and other breaches
A free Serus scan shows where your email address and phone number have appeared in known breaches and tells you what to do next.
Frequently asked
Was I affected?
If you were a patient of Yale New Haven Health, you may have received a letter in April 2025. 5,556,702 people were reported to HHS.
What was exposed?
Names, dates of birth, contact details, race or ethnicity, Social Security numbers, patient type and medical record numbers, depending on the person.
Were medical records stolen?
Reporting on the notice says financial information, medical records and treatment details weren't part of the data.
Should I change my password?
The notice doesn't mention passwords. Focus on a credit freeze and on phishing that mentions Yale New Haven.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
