Yale New Haven Health Exposes 5 Million Americans' Personal Information

A data breach at Yale New Haven Health (YNHHS) occurred on March 8th, 2025, exposing the personal information of millions of patients. The breach was attributed to YNHHS itself and involved external cybersecurity experts from Mandiant in an investigation with law enforcement assistance. The incident impacted approximately 5,556,702 patients across more than 360 locations in Connecticut, New York, and Rhode Island, affecting demographic data, Social Security numbers, medical records, and patient types. The breach was discovered when YNHHS spotted unusual activity on its IT systems, but notification to affected patients wasn't initiated until late April. As a result, lawsuits have already been filed by two individuals against YNHHS, alleging the organization failed to protect personally identifiable information and notify patients in a timely manner, with damages sought for free lifetime identity protection and changes to cybersecurity practices.