LeakNet Posts 11TB of NYC Health + Hospitals Patient Data on Dark Web

The NYC Health Hospitals data breach originated at a third-party vendor, not directly at the health system's own network perimeter. NYC Health + Hospitals confirmed in its official breach notice that an unnamed third-party vendor experienced a security failure that gave the attacker access to health system data. The specific vendor and access vector have not been disclosed publicly. This pattern, where attackers compromise a trusted supplier to reach a high-value target, is the dominant initial access technique in healthcare breaches throughout 2025 and 2026.

LeakNet's documented initial access method is ClickFix, a social engineering technique where attackers compromise legitimate websites and serve fake CAPTCHA verification pages. Visitors see a verification prompt that instructs them to copy a command from their clipboard and paste it into the Windows Run dialog. The command executes msiexec.exe to download and run a Deno-based in-memory loader. The Deno runtime executes Base64-encoded payloads directly from memory, leaving minimal forensic artifacts on disk and bypassing endpoint tools that rely on scanning files written to the filesystem.

Once inside the third-party vendor's environment, LeakNet used standard post-exploitation techniques: DLL side-loading to launch additional payloads, credential enumeration via cmd.exe to identify accessible accounts, lateral movement using PsExec, and data exfiltration staged through Amazon S3 buckets to blend with normal cloud traffic.

The 78-day dwell time, from November 25, 2025, through February 11, 2026, indicates that LeakNet operated without triggering detection controls throughout the breach period. NYC Health + Hospitals detected suspicious activity on February 2, 2026, nine days before the attacker's final recorded access. The breach was publicly disclosed on March 24, 2026. LeakNet published its dark web preview on July 27, 2026, more than five months after the breach ended, holding the data as leverage before escalating to public exposure.

The LeakNet preview published on July 27 confirmed that the stolen archive contains data across every high-value category for identity fraud and medical extortion.

Medical records form the core of the stolen data. LeakNet's preview screenshots show medical spreadsheets containing diagnoses, treatment plans, medications, and test results. Visible categories include mental health diagnoses, HIV records, and cancer-related appointments. Medical identity theft, where criminals use stolen records to bill insurers for services the victim never received, costs the healthcare system an estimated $7.7 billion annually in fraudulent claims.

Biometric data is the most permanent component of this breach. NYC Health + Hospitals confirmed that fingerprints and palm prints are included in the stolen records. Biometric identifiers cannot be changed or reissued. Every affected patient and employee carries this exposure for life. Stolen fingerprints can defeat biometric authentication systems in corporate environments, border crossings, law enforcement databases, and consumer devices.

The breach also covers financial and identity data: credit and debit card numbers, bank account details, Social Security numbers, driver's licenses, passport copies, and online account credentials. LeakNet's preview includes screenshots showing complete rows of patient-level records with names, addresses, phone numbers, dates of birth, and insurance membership numbers visible without redaction.

NYC Health + Hospitals confirmed that the breach affects anyone who worked for or received care at the system since 2020. The officially confirmed affected count reported to the Department of Health and Human Services stands at 1.8 million. LeakNet claims the full archive contains 12 million people. Independent verification of that figure has not been completed. The potential scale rivals past large healthcare breaches covered in our analysis of the ShinyHunters Abbott Labs attack.

LeakNet is a ransomware and data extortion group that emerged in November 2024, presenting itself as a "digital watchdog" committed to internet freedom and transparency. DarkFeed, a dark web threat intelligence service, confirmed the group listed over 10 victims on its darknet site within its first months of operation.

The group's technical signature is its ClickFix-based initial access chain. LeakNet compromises legitimate websites to serve fake CAPTCHA pages that trick users into executing msiexec.exe commands through the Windows Run dialog. A Deno-based in-memory loader then executes the second-stage payload directly from RAM, bypassing endpoint detection tools that scan files written to disk. This approach removes LeakNet's reliance on purchasing initial access from brokers, reduces per-victim cost, and lets the group scale targeting.

LeakNet's targeting has expanded from corporate IT environments into critical infrastructure and now into healthcare. The Hacker News documented LeakNet's March 2026 ClickFix campaigns attacking organizations across multiple industry verticals, with the group explicitly broadening into industrial targets. The NYC Health + Hospitals breach marks a further escalation: a municipal health system serving 12 million New Yorkers across 11 acute care hospitals, six long-term care facilities, and more than 70 community health centers.

LeakNet's extortion model follows the double extortion pattern used by major ransomware operators: exfiltrate data first, hold it as leverage, then escalate to public dark web exposure if demands go unmet. The July 27 preview is the escalation phase. NYC Health + Hospitals had not publicly addressed LeakNet's dark web post as of July 30, 2026.

No CVE-specific Sigma rule exists for this breach. LeakNet gained access through a third-party vendor using ClickFix social engineering rather than a direct vulnerability in NYC Health + Hospitals systems. The three rules below target ClickFix's known execution behavior at the Windows registry and process creation level. These rules apply to every Windows environment in your organization and across your vendor population, which is the current LeakNet target pool.

All three rules require Windows Sysmon Event ID 1 (process creation) and Event ID 13 (registry value set) as log sources. Ingest these events into your SIEM. Run in detection mode for 24 hours before activating blocks, to baseline normal Windows Run dialog usage in your environment. Alert on any hit involving msiexec.exe executing from a non-standard directory.

Specific network IOCs for the NYC Health Hospitals data breach have not been publicly confirmed. The breach originated at an unnamed third-party vendor, and LeakNet's specific infrastructure used in this intrusion has not been publicly documented as of July 30, 2026.

LeakNet's dark web leak site published a preview of the stolen archive on July 27, 2026. The preview screenshots visible to researchers contain unredacted patient names, addresses, Social Security numbers, dates of birth, and medical information. LeakNet has stated it will publish the remaining material in a future release.

For your vendor population, the key behavioral indicators to monitor are LeakNet's ClickFix delivery patterns: msiexec.exe executing from non-standard directories, Windows Run dialog registry entries containing HTTPS URLs with CAPTCHA-adjacent keywords such as verification, robot, or human, and outbound connections from workstations using the Deno JavaScript runtime as a User-Agent string. These patterns are covered by the Sigma rules in the prior section.

Seven actions to take immediately if you or your employees received care at any NYC Health + Hospitals facility since 2020. These steps apply whether or not you have received an official breach notification letter.

The NYC Health Hospitals data breach is not only a patient exposure event. It is a model for how ransomware groups are shifting from operational disruption to long-term identity destruction.

LeakNet's approach is deliberate. The group did not deploy ransomware and demand payment within 72 hours. It waited 78 days inside the network, collected data systematically, held the archive for five months, then published a preview to maximize extortion pressure. This extended timeline gives defenders no clean response window. By the time the dark web preview appeared on July 27, 2026, the data had already been organized, verified, and prepared for sale.

The third-party vendor entry point is now the most critical risk in healthcare security architecture. NYC Health + Hospitals runs 11 acute care hospitals, 6 long-term care facilities, and over 70 community health centers. Its vendor ecosystem is correspondingly large. A single compromised vendor with read access to patient records gives an attacker everything LeakNet published without touching the health system's own perimeter controls. Every healthcare organization that conducts periodic vendor security assessments but does not continuously monitor vendor-side data access patterns faces the same exposure.

For security teams: the priority actions are applying the Sigma detection rules in this post to your endpoint telemetry, reviewing your third-party vendor risk assessments for entities with access to patient data, and enabling dark web monitoring for your organization's email domains. The LeakNet preview contained screenshots of internal service desk communications and internal directory listings, indicating the vendor breach included access to administrative systems, not just patient-facing applications.

The biometric component sets this breach apart from all prior healthcare data incidents. Past large-scale breaches, including the ShinyHunters Abbott Labs attack, exposed financial and identity data that can be partially mitigated through credit monitoring and credential rotation. Fingerprints cannot be rotated. Every patient whose biometric data appears in the LeakNet archive carries permanent exposure, with no available mitigation beyond heightened authentication vigilance for the rest of their lives.