Cyberattack on Yale New Haven Health Sparks IT Security Scramble

Update, Oct. 19, 2026: This article was fact-checked and revised on Oct. 19, 2026. An earlier version included a quote attributed to a cybersecurity consultant that we could not trace to any published source, and a statement attributed to a Yale New Haven Health executive that we could not confirm; both have been removed. Statements below are attributed to published sources.

Summary

• Incident Overview: A cybersecurity incident disrupted IT services across Yale New Haven Health (YNHHS) over the weekend of March 8, 2025.
• Response Measures: YNHHS brought in the cybersecurity firm Mandiant to investigate and notified federal authorities.
• Patient Impact: The health system said patient care was not affected and its patient portal and electronic medical records were running normally.
• Broader Implications: The incident adds to a long run of cyberattacks on healthcare providers.

Unraveling the Yale New Haven Health Cyberattack

Yale New Haven Health System, Connecticut’s largest healthcare system, said on March 11, 2025, that it had identified “an issue affecting IT services across our Health System” over the preceding weekend. Its Digital and Technology Solutions team spotted the problem and began working to contain it, and an investigation with Mandiant determined that it was a cybersecurity incident.

Source: Yale New Haven Health statement, March 11, 2025

Nature of the Cyberattack

At the time, YNHHS did not say how the attackers got in or what kind of attack it was. The health system said it was notifying federal authorities and that Mandiant was conducting a thorough investigation. Staff were still dealing with intermittent internet and application connectivity problems, which the health system described as a deliberate part of its protocols for mitigating cybersecurity events while access to programs was rebuilt.

Source: Yale New Haven Health statement, March 11, 2025; NBC Connecticut, March 11, 2025

Response and Mitigation

Dana Marnane, director of public relations for Yale New Haven Health, told the New Haven Register that Mandiant was investigating “the full scope of the cybersecurity incident, including any exposure of employee or patient data.” She added that if employee or patient information turned out to be affected, the health system would notify those people directly as required by law.

Source: New Haven Register, March 11, 2025

Implications for Patient Care

YNHHS said its quick action to identify and contain the incident meant it “has not affected our ability to provide patient care.” The patient portal and electronic medical records were running as normal, while teams worked to manage the effect of phone and internet connection issues on care.

Source: Yale New Haven Health statement, March 11, 2025

What the Investigation Later Found

In April 2025, YNHHS said its investigation had found that an unauthorized third party gained access to its network and, on March 8, 2025, obtained copies of certain patient data. Depending on the patient, that data could include name, date of birth, address, phone number, email address, race or ethnicity, Social Security number, patient type and medical record number. The health system said its electronic medical record system was not accessed and that no financial account, payment or employee HR information was involved. It began mailing letters to affected patients and offered credit monitoring to those whose Social Security numbers were involved.

Source: Yale New Haven Health notice, April 11, 2025

The breach affected about 5.6 million people, according to a report filed with federal regulators, making it the largest healthcare breach reported to the HHS Office for Civil Rights at that point in 2025.

Source: Healthcare Dive, April 24, 2025

Broader Implications for the Healthcare Sector

Healthcare providers remain frequent targets. Barry Mathis, managing principal of IT advisory consulting at PYA, told Healthcare Dive that a stolen medical record gives criminals nearly everything they need to commit tax fraud or file fraudulent Medicare and Medicaid claims. The Yale New Haven incident came the year after the ransomware attack on Change Healthcare, which exposed data on about 190 million people and is the largest healthcare breach ever reported to federal regulators.

Source: Healthcare Dive, April 24, 2025

Wake-Up Call for Enhanced Cybersecurity Measures

As hospitals rely more on connected systems, their security has to keep pace. That means monitoring for unusual network activity, having tested plans for running with degraded IT, and working with outside responders, regulators and law enforcement when something goes wrong.

Conclusion

The Yale New Haven Health incident shows how an attack can strain a large health system’s IT even when care keeps running. The health system said patient care was not affected, but the investigation later found that attackers had copied data on millions of patients. For other providers, the lesson is that keeping operations up and keeping data safe are separate problems, and both need attention before an attack happens.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.