Data Security , Healthcare , Industry Specific

The chair of the U.S. Senate health committee is seeking answers from New York City officials - including the city's mayor - about a 2025 hack at the country's largest municipal public health system, New York City Health + Hospitals, that affected 1.8 million individuals.

See Also: The Healthcare CISO's Guide to Medical IoT Security

Sen. Bill Cassidy, R-La., a physician and chair of the Senate health, education, labor and pension committee, in a June 4 letter to NYC Health CEO Mitchell Katz and New York City mayor Zohran Mamdani, sought details about the 2025 health data breach health affecting nearly 2 million patients, as well as the cybersecurity controls in place leading up to the incident.

"At a time when hostile actors are increasingly using sophisticated tactics by leveraging artificial intelligence, it is essential for the healthcare sector to take meaningful steps to safeguard patient and consumer information," Cassidy said.

"NYC Health + Hospitals provides healthcare services to over 1 million patients every year, creating a substantial risk to the population NYC Health + Hospitals serves," Cassidy added, asking NYC Health officials to respond to his questions by June 18.

The senate leader wants more information about the types of security protocols - "both cyber and physical" - that NYC Health has in place to protect against cyberattacks, its cybersecurity best practices, when the organization became aware of the incident and the remedial steps taken or planned to improve its security.

NYC Health in a March 24 breach statement said the hackers appeared to have gained access to the organization's systems "due to a security breach at a third-party vendor." NYC Health has not publicly disclosed the identity of the vendor (see: Public NYC Health System Notifying 1.8M of Hack).

The long list of information potentially compromised in the breach includes health insurance information, such as Medicaid, Medicare and private policy ID numbers, medical information, billing claims, Social Security numbers, credit and debit card numbers and biometric data including fingerprints and palm prints.

NYC Health + Hospitals is a safety-net health system with 70 care locations, including multiple hospitals across the five boroughs of New York City.

Neither NYC Health nor the mayor's office immediately responded to ISMG's requests for comment on Cassidy's letter and for additional details about the incident, including the identity of the vendor involved.

Cassidy's office also did not immediately respond to ISMG's request for additional comment.

The Senate HELP leader sent a similar letter to insurance giant Aflac last August following a cyberattack against the company that affected 22.7 million people (see: U.S. Senator Calls for Details on Aflac Data Breach).

"Cybersecurity threats are one of the most significant risks currently affecting the healthcare system," Cassidy wrote in his letter to NYC Health.

Cassidy, who was elected to the Senate in 2014, is one of 20 physicians currently serving in the U.S. Congress. He recently lost his primary bid for Senate reelection after President Donald Trump endorsed his opponent.

He previously served in the U.S. House of Representatives representing Louisiana's sixth Congressional district.