New York Blood Center Data Breach

The forensic investigation found that the unauthorized party had access to the network from January 20 through January 26, 2025. New York Blood Center detected suspicious activity on January 26 and confirmed that it was a ransomware attack.

The organization developed a preliminary list of affected people on June 30 and completed the final list after an extensive review on August 12, 2025. Notification letters began mailing on September 5.

The unauthorized party accessed the organization's computer network and obtained a copy of certain files. The attack also disrupted systems, causing delays and cancellations in some blood-donation activities.

New York Blood Center did not disclose the technical means of access. Although the organization confirmed ransomware, it did not identify the responsible group, and reliable sources report no known claim of responsibility.

The official records list names, addresses, Social Security numbers, driver's-license or other government identification numbers, financial account information, and medical information.

The affected data varied by individual. This does not mean every listed field was present in every person's files.

The Texas Attorney General reports 193,822 affected people nationwide, including 10,557 Texas residents. HIPAA Journal also reports that the organization later confirmed the 193,822-person total.

Social Security numbers, government IDs, and financial account information can support identity theft, fraudulent account applications, or payment fraud. Medical information can make targeted messages appear to refer to a genuine blood donation or healthcare relationship.

For an unexpected message claiming to come from New York Blood Center, a hospital, or a bank, use the organization's official contact channel instead of following a supplied link. Accurate donation or health details do not prove the sender is authorized.

The organization said it worked with cybersecurity specialists to contain the attack, remove the actor from its network, notify law enforcement, and strengthen safeguards. It offered one year of credit monitoring and identity protection to eligible people whose Social Security or driver's-license numbers were affected.

Notice recipients can enroll in the offered protection service within the period stated in their letter and review credit reports, financial accounts, and health-insurance explanations for unfamiliar activity.

If an unfamiliar transaction, new account, or healthcare service appears, contact the relevant organization directly. Do not share a password, verification code, or payment information in response to an unexpected call or message.