First revealed in March, the incident was confirmed to be months long. NYC Health + Hospitals blamed the intrusion on an unnamed third-party vendor. Stolen data includes medical records, finger and palm prints, and location data from patients and workers alike.