Yale New Haven Health Under Siege in Cybersecurity Breach Investigation

Update, Oct. 19, 2026: This article was fact-checked and revised on Oct. 19, 2026. An earlier version included a quote credited to an unnamed “spokesperson from a reputable cyber defense firm” that we could not trace to any published source; it has been removed. Statements below are attributed to published sources.

Summary

• Yale New Haven Health (YNHHS) investigated a cybersecurity incident that disrupted IT services across the health system in March 2025.
• The health system worked with the cybersecurity firm Mandiant and notified federal authorities.
• YNHHS said patient care was not affected and its patient portal and electronic medical records kept running.
• The investigation later found that patient data had been copied. About 5.6 million people were affected.

Introduction

In March 2025, Yale New Haven Health, Connecticut’s largest healthcare system, became the latest hospital operator to deal with a cyberattack. The health system first described the problem as an issue affecting IT services and confirmed within days that it was a cybersecurity incident.

Source: New Haven Register, March 11, 2025

Anatomy of the Incident

YNHHS said on March 11 that its Digital and Technology Solutions team identified the issue over the weekend and began working to mitigate it. Working with Mandiant, the health system determined that it was a cybersecurity incident. Later notices put the start date at March 8, 2025, when YNHHS identified unusual activity affecting its IT systems.

Source: Yale New Haven Health statement, March 11, 2025; Yale New Haven Health notice, April 11, 2025

Outside Experts and Law Enforcement

The health system said it was notifying federal authorities and that Mandiant was conducting a thorough investigation. Dana Marnane, director of public relations for Yale New Haven Health, told the New Haven Register that the investigation would cover “the full scope of the cybersecurity incident, including any exposure of employee or patient data.”

Source: New Haven Register, March 11, 2025

Impact on Patients and Operations

YNHHS said the incident “has not affected our ability to provide patient care,” and that its patient portal and electronic medical records were running as normal. Staff still faced intermittent internet and application connectivity problems while access to programs was rebuilt, which the health system said was deliberate and part of its protocols for mitigating cybersecurity events.

Source: Yale New Haven Health statement, March 11, 2025

The investigation later found that an unauthorized third party had copied patient data on March 8, including demographic details, Social Security numbers, patient type and medical record numbers. The electronic medical record system was not accessed, according to YNHHS. The breach affected about 5.6 million people, the largest healthcare breach reported to federal regulators at that point in 2025.

Source: Yale New Haven Health notice, April 11, 2025; Healthcare Dive, April 24, 2025

Industry Perspectives

Healthcare data is a steady target. Barry Mathis, managing principal of IT advisory consulting at PYA, told Healthcare Dive that a stolen medical record gives criminals nearly everything they need to commit tax fraud or file fraudulent Medicare and Medicaid claims. “It’s a valuable commodity on the dark web,” he said.

Source: Healthcare Dive, April 24, 2025

Conclusion

Yale New Haven Health kept caring for patients through the attack, but the data theft that came to light weeks later is the part of the incident that will last. For other health systems, it is a reminder to plan for both: keeping clinical systems running during an attack, and limiting what an intruder can take.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.