Loading story…
The U.S. Federal Trade Commission, joined by California and Utah, sued telehealth provider Hims & Hers over allegations that it disclosed sensitive patient and health-related information to advertising and technology platforms including Meta and Snap while representing that it protected user privacy. Regulators say the company used tracking pixels and similar tools from multiple third parties, including Microsoft, Pinterest, Reddit, and X, to collect and transmit users’ website activity and health-related data without adequate disclosure or consent.
The complaint also alleges broader consumer protection violations, including charging some users before medical consultations and making subscription cancellations unnecessarily difficult, leading to recurring charges. Hims & Hers said its privacy policy explains users’ choices regarding data use and that it plans to contest the allegations, while the case adds to growing enforcement pressure on telehealth and healthcare firms over the use of advertising trackers on services handling sensitive medical information.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
In response to the lawsuit, Hims & Hers said its privacy policy explains users' choices about data use and stated that it intends to defend itself against the regulators' allegations.
The U.S. Federal Trade Commission, joined by the states of Utah and California, sued Hims & Hers alleging the telehealth company shared sensitive consumer health information with advertising platforms including Meta and Snap without adequate disclosure and misrepresented its privacy practices. The complaint also alleges deceptive billing and subscription cancellation practices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hims & Hers disclosed a breach of its third-party customer support platform after attackers used a social engineering attack to gain access between February 4 and February 7. The company said the intruders accessed and stole customer support tickets, and a breach notice was filed with the California attorney general's office. The compromised data primarily included customer names and email addresses, but support submissions may also have contained other personal, account, and healthcare-related information provided by users. Hims & Hers said customer medical records were not affected, did not disclose how many individuals were impacted, and has not said whether the attackers made any ransom or extortion demand.
Jun 29, 2026
Multiple legal actions highlighted ongoing **privacy and data-protection risk** across healthcare and consumer platforms. Epic Systems sued health information exchange implementer **Health Gorilla** and several provider organizations, alleging improper access to roughly **300,000 patients’ records** and claiming some participants abused interoperability frameworks (including **Carequality** and **TEFCA**) to obtain and monetize sensitive health data without appropriate consent or authorization. Separately, pharmacy services provider **PharMerica** agreed to a **$5.2 million** class-action settlement tied to a **2023** hacking incident attributed to the **Money Message** ransomware group, which claimed exfiltration of **4.7 TB** and later leaked data affecting **5.8 million** people (including SSNs and medication/insurance details), alongside commitments to invest further in security. Outside healthcare, California’s Attorney General opened a probe into **xAI** after **Grok** was used to generate and post non-consensual sexualized deepfakes, while Google agreed to pay **$8.25 million** to settle claims that its **AdMob SDK** collected data from children’s devices in “Designed for Families” apps in alleged violation of **COPPA**; a separate YouTube children’s-data settlement was also noted. A HIPAA Privacy Rule update was also reported as moving closer to finalization following an HHS OCR tribal consultation notice, but it is a regulatory development rather than a specific incident.
Jun 29, 2026
Nearly all 20 U.S. state-run health insurance marketplaces were found to be transmitting sensitive applicant data to major advertising and technology companies through misconfigured web tracking pixels. A Bloomberg investigation reported that data sent from exchange websites included details such as **race**, **sex**, email addresses, phone numbers, ZIP codes, country identifiers, and even whether applicants had incarcerated family members. The recipients reportedly included **Google, LinkedIn, Meta, Snap, and TikTok**, raising concerns that government healthcare platforms leaked protected personal and health-related information at scale. The exposure affected marketplaces used by more than **seven million Americans** buying health insurance this year, significantly widening the potential impact. Specific cases included New York's exchange sharing incarceration-related family information, Washington, D.C.'s exchange sending race and sex data to TikTok, and Virginia removing a Meta tracker after ZIP code sharing was identified. Following the findings, Washington, D.C. paused its TikTok tracker rollout and Virginia removed Meta's tracker, underscoring how embedded analytics and advertising tools on public-sector healthcare sites can create broad privacy risks.
Jun 29, 2026