Yale New Haven Health cyberattack

Analyst assessment

Yale New Haven Health identified unusual activity in its IT environment on March 8, 2025. Its March 11 public statement confirmed a cyber incident and an investigation with Mandiant. March 8 is the documented discovery date; the initial intrusion time remains unverified.

The health system’s April 11 disclosure confirmed that an unauthorized party accessed its network and copied certain data on March 8. The information varied by patient and could include demographics, Social Security numbers, patient type and medical record numbers. The organization said electronic medical records, financial accounts, payment information and employee HR data were excluded.

Operational significance

The incident and containment work caused intermittent phone, internet and application-connectivity problems. Patient care continued, and the health system said its patient portal and electronic medical records remained operational. These assurances coexist with documented communications limitations.

An official March 11 notice named both Yale New Haven Health and Yale Medicine as experiencing inbound-call issues. Patients were directed to MyChart for nonurgent needs and online options for appointments. March 12 reporting described another patient message warning that responses would be delayed.

In an April 24 interview with Information Security Media Group, a health-system spokesperson confirmed that internet and telephone connectivity had been restored. Operational status is assessed as resolved, with no exact end date assigned. March 12 is the latest verified disruption date in the reviewed evidence; April 24 establishes that restoration had occurred by then.

Confidence and uncertainty

Confidence is high in the cyber cause, connectivity disruption and data copying. The Identity Theft Resource Center’s first-half 2025 report records 5,556,702 victim notices for the health system. That is an attributed notification count, not a count of people who suffered identity fraud.

Ransomware encryption, a ransom demand or payment, and the perpetrator remain unverified. The health system declined to discuss those details with ISMG. The Rhysida attack on ECHN/Prospect hospitals and the Welltok breach are separate incidents; their clinical disruptions and attribution are excluded.

The settlement administrator reports an $18 million settlement, final approval on March 3, 2026, and payments beginning May 27. The case FAQ states that the defendant denies wrongdoing and that the court made no determination of wrongdoing. This settlement is distinct from a ransom or a measured recovery cost.

Analytic gaps

The initial access route, complete forensic findings and precise restoration date remain undisclosed in the reviewed evidence. Yale Medicine’s communications impact does not independently establish that its own patient data was copied. The available evidence does not establish hospital closures, emergency diversions or interruption of electronic medical records in this incident.