Yale New Haven Health notifies nearly 5.6M people of breach

Yale New Haven Health System, or YNHHS, reported a data breach to federal regulators that impacted nearly 5.6 million individuals, making it the largest healthcare data breach reported to HHS in 2025, so far. YNHHS is the largest healthcare system in Connecticut.

YNHHS discovered unusual activity within its IT systems on March 8, 2025, prompting it to launch an investigation and engage external cybersecurity experts. The investigation revealed that an unauthorized third party had gained access to the YNHHS network and obtained copies of certain data.

The information involved in the breach included names, birthdates, phone numbers, race or ethnicity, addresses, email addresses, patient type, medical record numbers and Social Security numbers. The health system's electronic medical records were not involved in the breach.

YNHHS assured patients that the incident never affected the health system's ability to provide patient care across its care sites.

The health system began mailing notification letters to impacted individuals in April.

"YNHHS considers the health, safety, and privacy of patients our top priority," a notice on the YNHHS website stated. "We are continuously updating and enhancing our systems to protect the data we maintain and to help prevent events such as this from occurring in the future."

The YNHHS is the second breach reported in April to have impacted upwards of 4 million individuals. Blue Shield of California recently notified 4.7 million people of a breach that stemmed from a configuration of Google Analytics that allowed it to share member data with Google Ads.

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.