New York Cybersecurity Breach Report 2026: $1.2B Lost

A factual analysis of New York's record $1.226 billion in reported cybercrime losses, the state's largest verified breaches, and the most aggressive state enforcement environment in the country.

Published by BlueRadius Cyber | August 2026 | All figures sourced and footnoted

This report compiles publicly verifiable New York-specific data on cybersecurity incidents, cybercrime losses, and regulatory enforcement across 2024, 2025, and early 2026. Every statistic comes from verified sources: the FBI Internet Crime Complaint Center (IC3) annual reports, the New York Attorney General's office, the New York Department of Financial Services (NYDFS), the HHS Office for Civil Rights (OCR), official statements from affected organizations, and established security reporting. Where a figure is approximate or disputed, the report says so.

Executive Summary

In 2025, New York crossed the $1 billion threshold in annual reported cybercrime losses for the first time. New Yorkers filed 45,255 complaints with the FBI IC3 and reported $1,226,307,877 in losses, #4 among U.S. states in both categories and a 36% year-over-year loss increase.[1][2] The state's regulators produced some of the most consequential enforcement actions in the country: a cumulative $20.79 million from ten auto insurers over exposures affecting roughly one million New Yorkers,[3] the first NYDFS enforcement under the amended Part 500 regulation,[15] and a new law that puts every New York municipality on a 72-hour incident reporting clock.[17]

The breach record is equally stark. NYC Health + Hospitals reported a vendor-linked breach affecting approximately 1.8 million people, including biometric identifiers.[9] And the Suffolk County ransomware attack stands as the state's definitive cautionary tale: more than $25 million in remediation costs for a county with no CISO, no cyber insurance, and an unheeded FBI warning three months before the attack.[4][5]

Key Findings

$1,226,307,877 in reported New York cybercrime losses in 2025, the first time the state crossed $1 billion, a 36% increase over 2024 and #4 nationally.[1][2]
45,255 New York IC3 complaints in 2025, up 24% from 36,468 in 2024, also #4 among U.S. states.[1][2]
New Yorkers aged 60 and older reported $408.74 million in 2025 losses across 8,537 complaints, up from $257.66 million in 2024.[1][2]
Approximately 1.8 million people affected in the NYC Health + Hospitals vendor breach reported to OCR in March 2026, the largest New York OCR filing of the window, including Social Security numbers, diagnoses, and fingerprint and palm-scan biometrics.[9]
More than $25 million in Suffolk County ransomware remediation costs, per the county legislature's September 2024 report, for an attack the FBI warned about three months in advance.[4][5]
$20.79 million in cumulative penalties against ten auto insurers whose quoting tools exposed data on roughly one million New Yorkers, including a $14.2 million eight-company sweep announced October 14, 2025.[3]
656,086 people affected in the OrthopedicsNY breach initially reported as 5,100, with notification delayed roughly ten months; the practice settled with the AG for $500,000 in late 2025.[8]
NYDFS Part 500's amended requirements fully phased in on November 1, 2025, following the first enforcement action under the amended regulation: a $2 million PayPal consent order in January 2025.[14][15]
New York municipalities must now report cyber incidents to the state within 72 hours and ransomware payments within 24 hours under Article 19-c of the General Municipal Law, signed June 26, 2025.[17]

Bottom line: New York organizations now operate in a state where cybercrime losses exceed $1 billion a year, where the Attorney General and NYDFS actively penalize weak security and slow notification, and where municipalities carry statutory reporting deadlines measured in hours. The cost asymmetry, a $25 million county recovery versus the price of the missing basic controls, is the central lesson for mid-market leadership.

The Headline Numbers: New York in the FBI IC3 2025 Annual Report

The FBI Internet Crime Complaint Center publishes annual state-by-state data on reported internet crime. The 2025 report marks a structural milestone for New York: the state's reported losses crossed $1 billion for the first time.[1]

National Context

New York ranked #4 among U.S. states in both complaint volume and dollar losses in 2025, holding the same #4 position it occupied in 2024.[1][2] New York's per-capita burden is somewhat lower than its absolute rank suggests: at $6.13 million in losses per 100,000 residents, the state ranked #10 nationally in 2025.[1] The absolute numbers, however, moved sharply in one direction.

New York Breakdown

In 2024, New Yorkers filed 36,468 IC3 complaints and reported $903,975,003 in losses, both #4 nationally.[2] In 2025, complaints rose 24% to 45,255 and losses rose 36% to $1,226,307,877.[1] The dollar growth outpacing complaint growth indicates larger average losses per incident, consistent with the national shift toward high-dollar fraud categories.

The elder-fraud pattern intensified alongside the overall totals. New Yorkers aged 60 and older filed 6,225 complaints with $257.66 million in losses in 2024; in 2025 the cohort filed 8,537 complaints with $408.74 million in losses, #4 nationally both years.[1][2] Cryptocurrency-related complaints from New York numbered 8,053 in 2024, also #4 among states.[2] For banks, credit unions, healthcare systems, and insurers whose customers skew older, these figures describe a fraud environment aimed at their customer base as much as at their own infrastructure.

Major New York Breaches and Incidents, 2024 to Early 2026

The incidents below are confirmed by official filings, legislative reports, entity statements, or established security reporting. They span county government, city government, healthcare, education, and critical health infrastructure.

Suffolk County: The $25 Million Cautionary Tale

On September 8, 2022, the ALPHV/BlackCat ransomware group compromised Suffolk County's systems through the Log4j vulnerability. The county's public website stayed down for five months, 911 dispatch operations were disrupted, and data on roughly 470,000 residents and 26,000 county employees was exposed.[4][5] The full accounting arrived on September 18, 2024, when the county legislature's special committee published its investigative report: remediation costs exceeded $25 million, with Newsday reporting the figure at $25.7 million.[4]

The report's findings read as a checklist of governance failures. The county had received an FBI warning in June 2022, three months before the attack, and did not act on it. It had no CISO. It carried no cyber insurance.[4][5] Suffolk County anchors this report because it prices the alternative: the absent controls cost a small fraction of the $25 million recovery, and the accountability gap, no single executive owning cyber risk, is the condition most mid-market organizations and municipalities share.

NYC Health + Hospitals: Approximately 1.8 Million Affected, Biometrics Included

NYC Health + Hospitals, the largest municipal public health system in the United States, disclosed a breach traced to an intrusion at a vendor. The unauthorized access ran from November 25, 2025 to February 11, 2026 and was detected on February 2, 2026.[9] The system reported the breach to the HHS Office for Civil Rights on March 24, 2026, listing approximately 1.8 million affected individuals, the largest New York OCR filing of this report's window.[9]

The exposed data included Social Security numbers, diagnoses, and fingerprint and palm-scan biometrics.[9] The biometric element matters: unlike a Social Security number, a fingerprint cannot be reissued. The incident also drew a Senate HELP Committee inquiry, a sign that large vendor-channel healthcare breaches now carry congressional as well as regulatory exposure.[9]

Northwell Health via PJ&A: The Vendor Multiplier

The 2023 breach of medical transcription vendor Perry Johnson & Associates (PJ&A) affected 8,952,212 people per PJ&A's OCR filing, with Northwell Health among the affected covered entities. The New York Attorney General issued a consumer warning in response.[12] It remains the clearest New York illustration of vendor concentration risk: one transcription vendor's compromise propagated into millions of patient records.

HealthAlliance / WMCHealth: Unpatched Citrix, Ambulance Diversions, an AG Settlement

Attackers accessed HealthAlliance systems (part of the Westchester Medical Center Health Network) between August 18 and October 13, 2023, exploiting an unpatched Citrix NetScaler appliance. Roughly 264,000 people were notified, and the disruption forced ambulance diversions.[11] On December 9, 2024, the New York Attorney General announced a settlement covering 242,641 New York residents: $1.4 million in penalties with $850,000 suspended, leaving $550,000 paid.[7] The AG's theory: a known, patchable vulnerability left open is a failure of reasonable safeguards.

New York Blood Center: Ransomware During a Blood Emergency

New York Blood Center Enterprises detected ransomware on January 26, 2025, with the intrusion running January 20 to 26.[10] The attack forced blood drive cancellations during a declared blood emergency, and more than 200 hospital customers had to activate workarounds.[10] Notifications did not begin until September 5, 2025, and the final affected count has been described only as tens of thousands of people; no precise verified total is available.[10] Ransomware against health infrastructure creates clinical supply risk, not just data risk.

NYU: A Website Hijack Exposing 3 Million Applicant Records

On March 22, 2025, an attacker hijacked New York University's website for roughly two to three hours, posting CSV files containing data on more than 3 million applicants dating back to 1989, including test scores, GPAs, and financial aid information. NYU confirmed the incident in an official memo.[13] The exposure window was short, but the dataset's depth made it one of the more unusual higher-education incidents of the period.

City of Newburgh: A Small City Knocked Offline

In June 2024, ransomware hit the City of Newburgh, a Hudson Valley city of roughly 30,000 residents. Tax, water, sewer, permitting, and parking systems went down, and City Hall closed for several days.[6] No ransomware gang has been publicly attributed. Newburgh represents the exposure most New York municipalities actually carry: the loss of every revenue and service system at once, without deep security staffing.

NYCAPS Smishing: Payroll Credential Theft Against NYC Employees

In April 2024, attackers ran a smishing campaign against users of NYCAPS, New York City's employee payroll portal, sending fake multi-factor authentication text messages that directed employees to a fraudulent site at essnyc.online. The city took the self-service site offline while NYC Cyber Command responded.[6] The target was the login, not the network, the current attacker preference in one sentence.

PowerSchool: A National Vendor Breach Lands in New York Schools

The compromise of PowerSchool, a student information system vendor used widely across the country, reached New York districts and triggered a statewide incident response process coordinated by the New York State Education Department.[16] In New York City, approximately 3,431 students and 317 staff across four schools were affected per the city's schools notification.[16] For K-12 leaders, the lesson is that district data risk concentrates in national education vendors, not district-run systems.

Carthage Area Hospital and Claxton-Hepburn Medical Center: Rural Hospitals Under LockBit

In November 2023, the LockBit ransomware group claimed attacks on Carthage Area Hospital and Claxton-Hepburn Medical Center, two North Country hospitals that together serve a region of more than 200,000 people. The attacks caused roughly two weeks of disruption, including ambulance diversions.[10] Rural hospitals carry the least security staffing and the least redundancy; in the North Country, the next hospital is not nearby.

Long Island Plastic Surgical Group: 161,707 Patients

Long Island Plastic Surgical Group suffered a breach between January 4 and 8, 2024, affecting 161,707 people per its OCR filing.[12] Specialty practices hold unusually sensitive clinical records and photographs while typically running small IT operations, a combination extortion groups deliberately target.

Northeast Radiology: A $350,000 OCR Settlement for an Exposed PACS Server

On April 10, 2025, HHS OCR announced a $350,000 settlement with Northeast Radiology of Brewster, New York, the sixth action under OCR's Risk Analysis Initiative.[18] The underlying failure was a PACS medical imaging server left exposed to the internet across 2019 and 2020, affecting 298,532 people.[18] The signal to covered entities: the absence of an accurate, current risk analysis is itself the violation.

The New York Regulatory Environment

New York layers three enforcement regimes on top of federal requirements: the SHIELD Act's reasonable-safeguards and breach notification obligations enforced by the Attorney General, the NYDFS Part 500 cybersecurity regulation for financial services entities, and, as of 2025, statutory incident reporting duties for municipalities.

The Attorney General's Enforcement Machine

The New York Attorney General has become one of the most active state privacy enforcers in the country. In 2024 alone, the office secured penalties exceeding $14 million from twelve companies over data security failures.[19]

The signature campaign is the auto-insurance quoting sweep, targeting companies whose auto-quote prefill features let attackers harvest driver's license numbers and other personal data at scale. In 2024, the AG and NYDFS jointly settled with GEICO and Travelers for $11.3 million over exposures affecting more than 120,000 New Yorkers, alongside a $500,000 settlement with Noblr.[3] On March 20, 2025, Root settled for $975,000 over an exposure affecting roughly 45,000 people, and Wojeski settled for $60,000 later in 2025.[3] On October 14, 2025, the AG announced $14.2 million from eight more auto insurers whose quoting tools exposed data on more than 825,000 New Yorkers, bringing the campaign to $20.79 million across ten insurers and roughly one million New Yorkers.[3]

Healthcare enforcement followed the same logic. The HealthAlliance settlement (December 2024) priced an unpatched Citrix appliance at $1.4 million, $550,000 of it paid.[7] The OrthopedicsNY settlement in late 2025 targeted notification failure as much as the breach: after a December 28, 2023 attack by the INC Ransom group, the practice initially reported 5,100 affected people, delayed notification roughly ten months, and ultimately acknowledged 656,086. The AG settled for $500,000.[8]

The office also works multistate. On July 14, 2026, New York joined a $18 million 23andMe settlement across 44 jurisdictions; New York's share exceeded $705,000, covering 305,245 New Yorkers.[20]

NYDFS Part 500: The Amended Regulation Is Now Fully in Force

The NYDFS cybersecurity regulation (23 NYCRR Part 500) governs banks, insurers, and other financial services companies licensed in New York, and its Second Amendment finished phasing in during this window. Governance, encryption, and incident response / business continuity requirements took effect November 1, 2024; annual certifications were due April 15; additional technical requirements landed May 1, 2025; and the final phase, expanded multi-factor authentication and asset inventory requirements, took effect November 1, 2025.[14]

NYDFS also delivered the first enforcement action under the amended regulation: a $2 million consent order against PayPal on January 23, 2025, arising from a 2022 incident in which IRS Form 1099-K data, including Social Security numbers, was exposed.[15] Covered entities should read the sequence plainly: the phase-in is over, the certification obligation is annual, and the department has shown it will enforce the amended text.

Article 19-c: A 72-Hour Reporting Clock for Every New York Municipality

On June 26, 2025, New York enacted Article 19-c of the General Municipal Law, with the state announcing its effect on July 28, 2025. Municipalities must now report cybersecurity incidents to the Division of Homeland Security and Emergency Services (DHSES) within 72 hours, report any ransomware payment within 24 hours with detailed follow-up within 30 days, and provide annual cybersecurity awareness training.[17] New York is among the first states to place statutory incident and ransom-payment reporting deadlines directly on local governments. For municipal officials, the meaning is concrete: incident response can no longer be improvised, because the state clock starts at discovery whether or not the municipality is ready.

State Support Programs

The state pairs these obligations with support. New York published its first statewide cybersecurity strategy in August 2023.[21] Its $30 million county shared-services program, launched in July 2022, provides CrowdStrike endpoint detection and response to counties, alongside a Joint Security Operations Center collaboration with Albany, Buffalo, Syracuse, Rochester, and Yonkers.[21] Under the federal State and Local Cybersecurity Grant Program, New York opened a new application round September 24, 2025, with $9 million previously awarded.[21]

What This Means for New York Mid-Market Organizations

Three operational implications drop directly out of the data:

1. Governance failures, not exotic attacks, produced the biggest losses

Suffolk County's $25 million recovery traces to a known vulnerability, an ignored FBI warning, no CISO, and no cyber insurance.[4] HealthAlliance's penalty traces to an unpatched appliance.[7] Northeast Radiology's settlement traces to a missing risk analysis.[18] None of these required a sophisticated adversary to become expensive; they required an accountability vacuum. The highest-leverage move for a mid-market organization is to make one qualified executive own cyber risk. For organizations that cannot justify a full-time hire, virtual CISO services exist precisely to fill that seat at a fraction of the cost.

2. Notification speed is now an enforcement target of its own

OrthopedicsNY's ten-month delay and 5,100-to-656,086 revision drew a $500,000 settlement in which the notification failure was central.[8] NYDFS-covered entities face annual certification against the fully phased-in Part 500 text, and municipalities face 72-hour and 24-hour statutory clocks under Article 19-c.[14][17] The common requirement is rehearsed incident response: scoping, counsel, and notification workflows pre-positioned rather than assembled mid-crisis. A fractional CISO engagement is the standard mid-market mechanism for building and rehearsing that capability before it is tested.

3. Vendor and identity channels are the dominant intake paths

The largest New York breaches of the window arrived through vendors (NYC Health + Hospitals, Northwell via PJ&A, PowerSchool) or identity attacks (NYCAPS smishing, the auto-quote prefill abuse behind the $20.79 million sweep).[3][9][12][16] Security programs still centered on perimeter and endpoint tooling are aimed at the wrong layer. Continuous vendor risk monitoring and identity-first controls, including the hardened MFA Part 500 now mandates, are the matching countermeasures.

For organizations in the city, the concentration of financial services, healthcare, and professional services firms in Manhattan puts them inside both the NYDFS perimeter and the AG's enforcement focus. BlueRadius provides virtual CISO services in Manhattan for exactly this population: firms large enough to carry regulatory obligations, not yet large enough to staff a full security executive team.

Frequently Asked Questions

How much did New Yorkers lose to cybercrime in 2025?

$1,226,307,877 in reported losses, per the FBI IC3 2025 Annual Report, #4 among U.S. states. It was the first year New York's losses exceeded $1 billion, a 36% increase over the $903,975,003 reported in 2024.[1][2]

How many cybercrime complaints did New York file in 2025?

45,255 complaints, #4 nationally and up 24% from 36,468 in 2024. New Yorkers aged 60 and older accounted for 8,537 of those complaints and $408.74 million of the losses.[1][2]

What was the largest New York healthcare breach of 2025 to 2026?

The NYC Health + Hospitals vendor breach, reported to HHS OCR on March 24, 2026 with approximately 1.8 million people affected. The vendor intrusion ran from November 25, 2025 to February 11, 2026 and exposed Social Security numbers, diagnoses, and fingerprint and palm-scan biometrics.[9]

What happened in the Suffolk County cyberattack, and what did it cost?

The ALPHV/BlackCat ransomware group compromised Suffolk County on September 8, 2022 via Log4j. The county legislature's September 18, 2024 report put remediation above $25 million (Newsday: $25.7 million), with roughly 470,000 residents and 26,000 employees affected, the website down five months, and 911 disrupted. The county had ignored a June 2022 FBI warning, had no CISO, and carried no cyber insurance.[4][5]

What does Article 19-c require of New York municipalities?

Signed June 26, 2025, Article 19-c of the General Municipal Law requires municipalities to report cybersecurity incidents to DHSES within 72 hours, report any ransomware payment within 24 hours with detailed follow-up within 30 days, and conduct annual cybersecurity awareness training.[17]

What changed under NYDFS Part 500 in 2025?

The Second Amendment to Part 500 completed its phase-in: technical requirements took effect May 1, 2025, and the final phase, expanded multi-factor authentication and asset inventory requirements, took effect November 1, 2025. NYDFS also issued its first enforcement under the amended regulation, a $2 million PayPal consent order on January 23, 2025.[14][15]

How active is the New York Attorney General on data security?

Among the most active in the country: more than $14 million from twelve companies in 2024, a cumulative $20.79 million campaign against ten auto insurers through October 2025, healthcare settlements with HealthAlliance and OrthopedicsNY, and the $18 million multistate 23andMe settlement announced July 14, 2026.[3][7][8][19][20] Organizations unsure where they stand can request a free cybersecurity assessment to baseline their exposure.

Cite This Report

Journalists, researchers, policymakers, and security teams are welcome to cite this report with attribution. The suggested citation format is:

Source: "New York Cybersecurity Breach Report 2025-2026," BlueRadius Cyber, a virtual CISO services firm. https://blueradius.io/new-york-cybersecurity-breach-report-2026

Media inquiries and questions about the underlying data can be directed to our contact page.

Engage a vCISO to Operationalize These Findings

The pattern across this report is consistent: the most expensive New York incidents trace to absent security leadership, unmanaged vendors, and unrehearsed response, not to unstoppable adversaries. Those are program problems, solvable at mid-market budgets. BlueRadius's virtual CISO services place a senior security leader inside your organization with explicit ownership of vendor risk, identity controls, obligations under SHIELD, Part 500, and Article 19-c, and a breach response capability that fits the state's reporting clocks.

The starting point is knowing where you stand. Request a free cybersecurity assessment and we will map your current posture against the failure patterns documented in this report.

BlueRadius Research Library

Sources

[1] FBI Internet Crime Complaint Center, "2025 Internet Crime Report" (state statistics for New York). ic3.gov

[2] FBI Internet Crime Complaint Center, "2024 Internet Crime Report" (state statistics for New York). ic3.gov

[3] New York Attorney General, auto insurance data security settlement announcements, including the October 14, 2025 eight-insurer agreement. ag.ny.gov

[4] Suffolk County Legislature, Special Committee report on the 2022 ransomware attack, September 18, 2024; $25.7 million per Newsday. scnylegislature.us

[5] Cybersecurity Dive, reporting on the Suffolk County legislative findings. cybersecuritydive.com

[6] The Record (Recorded Future News), reporting on the June 2024 Newburgh ransomware attack and the April 2024 NYCAPS smishing campaign. therecord.media

[7] New York Attorney General, HealthAlliance / Westchester Medical Center Health Network settlement announcement, December 9, 2024. ag.ny.gov

[8] The HIPAA Journal and CBS6 Albany, reporting on the OrthopedicsNY breach and New York AG settlement. hipaajournal.com

[9] NYC Health + Hospitals official breach notice; The HIPAA Journal and Fierce Healthcare on the OCR filing and Senate inquiry. nychealthandhospitals.org

[10] The Record and The HIPAA Journal, reporting on the New York Blood Center ransomware attack and the Carthage Area Hospital / Claxton-Hepburn Medical Center attacks. therecord.media

[11] WMCHealth statements and CBS News reporting on the HealthAlliance Citrix intrusion. wmchealth.org

[12] The HIPAA Journal, OCR filing coverage for PJ&A / Northwell Health and Long Island Plastic Surgical Group; New York AG consumer alert. hipaajournal.com

[13] New York University, official community memo on the March 22, 2025 website incident; The Record reporting. nyu.edu

[14] Hinshaw & Culbertson and Hogan Lovells, client analyses of the NYDFS Part 500 Second Amendment phase-in schedule. hinshawlaw.com

[15] New York Department of Financial Services, PayPal consent order, January 23, 2025; Hunton Andrews Kurth analysis. dfs.ny.gov

[16] New York State Education Department and NYC Public Schools, PowerSchool incident notifications; GovTech reporting. nysed.gov

[17] Governor of New York and NYS DHSES, announcements on Article 19-c of the General Municipal Law, June 26 and July 28, 2025. governor.ny.gov

[18] HHS Office for Civil Rights, Northeast Radiology resolution agreement, April 10, 2025. hhs.gov

[19] IAPP, analysis of 2024 New York Attorney General data security enforcement (twelve companies, more than $14 million). iapp.org

[20] New York Attorney General, 23andMe multistate settlement announcement, July 14, 2026. ag.ny.gov

[21] New York State Office of Information Technology Services, statewide cybersecurity strategy (August 2023), county shared-services program, and State and Local Cybersecurity Grant Program announcements. its.ny.gov

All figures and named incidents in this report are drawn from publicly available primary sources or established secondary reporting. Where a count is approximate, such as the New York Blood Center total, the report says so and does not assign a precise number.

New York Cybersecurity Breach Report 2025-2026: $1.2B in Losses, Record Enforcement