Yale New Haven Battles Mysterious Cyber Threat Over Weekend

Update, Oct. 19, 2026: This article was fact-checked and revised on Oct. 19, 2026. An earlier version included a quote credited to a Yale New Haven Health spokesperson via the New Haven Register that does not appear in the Register’s reporting, a quote from an anonymous source, and a quote from a cybersecurity analyst we could not identify. Those quotes have been removed. Statements below are attributed to published sources.

Summary

• Incident Details: Yale New Haven Health identified an issue affecting IT services across its health system over the weekend of March 8, 2025, and later confirmed it was a cybersecurity incident.
• Immediate Response: The health system brought in the cybersecurity firm Mandiant and notified federal authorities.
• Impact on Operations: YNHHS said patient care was not affected, though staff dealt with intermittent phone, internet and application problems.
• Later Findings: An investigation found that attackers copied patient data on March 8. About 5.6 million people were affected.

Introduction

Yale New Haven Health, Connecticut’s largest healthcare system, spent the weekend of March 8, 2025, dealing with a problem in its IT systems that turned out to be a cyberattack. When the health system first spoke publicly on March 11, it had not said who was behind the attack or how they got in.

Source: New Haven Register, March 11, 2025

Incident Details

In a statement on March 11, YNHHS said its Digital and Technology Solutions team had “identified an issue affecting IT services across our Health System” over the weekend and began working to contain it. An investigation with Mandiant determined that the issue was a cybersecurity incident.

Dana Marnane, director of public relations for Yale New Haven Health, told the New Haven Register that Mandiant was investigating “the full scope of the cybersecurity incident, including any exposure of employee or patient data.” If employee or patient information was affected, she said, the health system would notify those people directly in line with its legal obligations.

Source: Yale New Haven Health statement, March 11, 2025; New Haven Register, March 11, 2025

Immediate Response

YNHHS said it was notifying federal authorities and that Mandiant was conducting a thorough investigation. While access to programs was rebuilt, the health system deliberately left some internet and application connections limited, describing this as part of its protocols for mitigating cybersecurity events.

Source: Yale New Haven Health statement, March 11, 2025

Impact on Operations

The health system said its quick action to identify and contain the incident meant it “has not affected our ability to provide patient care.” Its patient portal and electronic medical records ran normally, and teams worked to limit the effect of phone and internet problems on care.

Source: NBC Connecticut, March 11, 2025

What the Investigation Found

On April 11, 2025, YNHHS said the investigation had found that an unauthorized third party gained access to its network and, on March 8, obtained copies of certain data. Depending on the patient, that could include demographic details, Social Security numbers, patient type and medical record numbers. The health system said its electronic medical record system was not accessed and that no financial account, payment or employee HR information was involved.

Source: Yale New Haven Health notice, April 11, 2025

In its report to the HHS Office for Civil Rights, YNHHS said 5,556,702 people were affected. The health system began mailing notices on April 14 and offered free credit monitoring and identity protection to people whose Social Security numbers were involved. By late April, patients had filed two federal lawsuits over the breach, according to the Hartford Business Journal as cited by Healthcare Finance News.

Source: Healthcare Finance News, April 25, 2025

Preventative Measures

The incident shows why hospitals need more than an incident-response contract. Spotting unusual network activity early, being able to run clinical systems while other parts of the network are cut off, and knowing which data would be exposed if attackers got in all made a difference here. Patient care kept running, but data on millions of people was still copied.

Conclusion

The attack on Yale New Haven Health started as a weekend IT problem and became the largest healthcare breach reported to federal regulators in the first months of 2025. The health system kept treating patients, but the stolen data shows that keeping services running and protecting records are two separate jobs, and both need planning before an attack.

Source: Healthcare Dive, April 24, 2025

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.