Loading story…
Hims & Hers disclosed a breach of its third-party customer support platform after attackers used a social engineering attack to gain access between February 4 and February 7. The company said the intruders accessed and stole customer support tickets, and a breach notice was filed with the California attorney general's office.
The compromised data primarily included customer names and email addresses, but support submissions may also have contained other personal, account, and healthcare-related information provided by users. Hims & Hers said customer medical records were not affected, did not disclose how many individuals were impacted, and has not said whether the attackers made any ransom or extortion demand.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
Hims & Hers started mailing breach notification letters to affected individuals after the incident and offered 12 months of complimentary single-bureau credit monitoring and identity theft protection. The company also said it had notified law enforcement and regulators as part of its response.
BleepingComputer reported that the Hims & Hers breach was allegedly carried out by the ShinyHunters extortion gang as part of a broader campaign abusing compromised Okta SSO accounts to access SaaS platforms. In Hims & Hers' case, the attackers reportedly used an Okta SSO account to access the company's Zendesk instance and steal millions of support tickets.
Hims & Hers disclosed the incident in a notice filed with the California attorney general's office. The company said customer medical records were not affected, but did not disclose how many individuals were impacted.
On March 3, 2026, Hims & Hers determined that the compromised support tickets contained personal information for a limited set of individuals, including names and contact details. The company said the exposed data did not include personal healthcare information or patient-provider communications.
Between February 4 and February 7, attackers used a social engineering attack to gain access to Hims & Hers' third-party customer service ticketing platform. They accessed customer support tickets containing personal information, primarily names and email addresses, and potentially other account and healthcare-related details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
7 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcedarkreading.com
Open sourceteiss.co.uk
Open sourcehipaajournal.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Federal Trade Commission, joined by California and Utah, sued telehealth provider **Hims & Hers** over allegations that it disclosed sensitive patient and health-related information to advertising and technology platforms including **Meta** and **Snap** while representing that it protected user privacy. Regulators say the company used tracking pixels and similar tools from multiple third parties, including Microsoft, Pinterest, Reddit, and X, to collect and transmit users’ website activity and health-related data without adequate disclosure or consent. The complaint also alleges broader consumer protection violations, including charging some users before medical consultations and making subscription cancellations unnecessarily difficult, leading to recurring charges. Hims & Hers said its privacy policy explains users’ choices regarding data use and that it plans to contest the allegations, while the case adds to growing enforcement pressure on telehealth and healthcare firms over the use of advertising trackers on services handling sensitive medical information.
Jul 31, 2026
Astrana Health disclosed that attackers impersonated company personnel and spoofed its main corporate telephone number in a social-engineering campaign that gained access to company servers. The California-based healthcare-management company confirmed that private and confidential information was exfiltrated, while it investigates whether patient, employee, provider, business, financial, intellectual-property, or other sensitive data was affected. Astrana characterized the incident as material because of the potentially sensitive information involved, though it said it does not expect a material impact on financial condition or operations. The company rotated credentials, restricted remote-access tools, rebuilt and restored affected systems from clean backups, and enhanced monitoring, logging, and detection; it also notified law enforcement, regulators, customers, and partners. No threat actor had claimed responsibility, and Astrana has not confirmed ransomware involvement.
Sep 26, 2026
AdaptHealth confirmed that a cyberattack exposed the personal and health information of **4,115,802 individuals**. The intrusion began on June 5, 2026, after attackers allegedly used social engineering to compromise a privileged account belonging to a third-party provider, gaining access to cloud applications, patient-management systems, document storage, and electronic health-record portals. Exposed data includes identity and contact details, demographic information, health-insurance information, and protected health information. An unidentified actor issued a ransom demand on June 15; ShinyHunters is suspected because AdaptHealth briefly appeared on the group’s extortion portal, though the company has not formally attributed the incident to the group.
Sep 11, 2026