New York Blood Center reports ransomware attack disrupting blood donations
Learn More
On January 26, 2025, New York Blood Center Enterprises detected suspicious activity within its IT systems, which was confirmed as a ransomware attack. NYBC, one of the largest independent blood centers in the United States, supplies over 1 million blood products annually to more than 400 hospitals and medical facilities across New York, New Jersey, and 15 other states covering a population of over 75 million people.
Several blood drives had to be canceled. The organization engaged third-party cybersecurity experts to investigate and contain the threat and law enforcement has been notified.
The attack occurred five days after NYBC declared a blood emergency due to a 30% drop in donations during the holiday season. Prior to the attack, the organization had reported that types O-negative and B-negative were down to a dangerously low 1-3 day supply.
Due to the incident, processing times for blood donations are longer than normal. NYBC has implemented manual workarounds to maintain essential services and is maintaining direct communication with hospital partners to fulfill orders.
NYBC has not disclosed whether any personally identifiable information or patient data was compromised in the breach.
The organization has no specific timetable for system restoration. Some blood drives and donation center activities are being rescheduled, but NYBC is still accepting blood donations despite longer processing times.
Update - As of 9th of September 2025, NYBC confirmed that the attack caused a data breach. Attackers had maintained unauthorized access to the organization's network for six days and stole personal and medical information from both patients and employees. According to breach notifications, the compromised information includes:
- Names
- Social Security numbers
- Driver's license numbers
- Financial account information
- Employment-related information
- Health information and test results
The total number of affected individuals is not disclosed, but the company told regulators in Texas that 10,557 people from the state were impacted.
As of 18th of September 2025, NYBC confirmed that nearly 194,000 people were affected by the data breach.
