Loading story…
A Florida-based technology firm, OutcomesOne, which provides medication therapy management and related services to health plans, experienced a significant data breach due to a targeted phishing attack. The incident was discovered on July 1, 2025, when an employee noticed unusual activity in their work email account and promptly reported it to the company's security team. The breach was contained to a single employee's email account, which was accessed by an unauthorized party for approximately one hour. During this brief window, the attacker was able to access files and emails containing sensitive information. The compromised data included names, demographic details, medical provider names, health insurance information, and medication information of nearly 150,000 individuals. Importantly, Social Security numbers were not affected by this breach. OutcomesOne responded quickly by securing the affected email account and confirmed that no other accounts were impacted. The company reported the incident to several state regulators and began notifying affected individuals about the potential exposure of their protected health information (PHI). The breach highlights the ongoing risk posed by phishing attacks, which remain a leading cause of health data breaches. OutcomesOne's swift detection and containment efforts limited the scope of the incident, but the exposure of PHI underscores the need for robust email security and employee awareness. The company has not disclosed whether any of the compromised information has been misused. Regulatory authorities are monitoring the situation, and OutcomesOne is likely to face scrutiny regarding its security practices and breach notification procedures. The incident serves as a reminder that even short-lived compromises can have far-reaching consequences when sensitive health data is involved. The breach also raises questions about the effectiveness of current anti-phishing measures and the importance of rapid incident response. OutcomesOne is expected to review and strengthen its security protocols to prevent similar incidents in the future. The notification process for affected individuals is ongoing, and the company is offering support to those whose information was exposed. This event adds to the growing list of healthcare sector breaches driven by phishing, emphasizing the sector's vulnerability to such attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The company reported the incident to multiple state regulators, including California and Oregon, as part of its breach notification process. At the time of reporting, the incident had not yet appeared on the HHS OCR HIPAA Breach Reporting Tool.
OutcomesOne disclosed that the incident potentially exposed PHI for nearly 150,000 individuals, including names, demographic details, provider name, health insurance information, and medication information, but not Social Security numbers. The affected individuals were identified as patients with Aetna health plans for which OutcomesOne provides medication therapy services.
On July 1, OutcomesOne detected the unauthorized access after the employee noticed unusual activity, and its security team quickly secured the affected account. The company said it found no evidence that any other email accounts were impacted.
A single OutcomesOne employee email account was accessed without authorization for about one hour in a phishing-related compromise. During the exposure window, the attacker accessed emails and files containing protected health information.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several US organizations have reported significant data breaches affecting thousands of individuals. Pearlman Aesthetic Surgery in New York disclosed a hacking incident compromising the protected health information of nearly 12,000 patients, though specific details remain undisclosed. Methodist Homes of Alabama and Northwest Florida notified residents and employees of a second breach within seven months, involving unauthorized access to an employee email account containing sensitive personal and medical information. Gulshan Management Services, which operates over 150 gas stations and convenience stores, confirmed a breach that exposed the personal data of more than 377,000 people, including Social Security numbers and financial information, with delayed notification to affected individuals. Community First Medical Center in Chicago reached a $1 million preliminary settlement following a 2023 breach that exposed the data of approximately 216,000 patients, with allegations of inadequate cybersecurity measures and delayed response. These incidents have led to regulatory filings, class action lawsuits, and increased scrutiny over the timeliness and adequacy of breach notifications. The breaches highlight ongoing challenges in protecting sensitive data across healthcare and retail sectors, with attackers exploiting both network vulnerabilities and email accounts. Organizations are facing legal and reputational consequences, emphasizing the need for robust cybersecurity practices and prompt communication with affected individuals.
Jun 29, 2026
Xsolis, a Tennessee-based healthcare technology company and business associate for HIPAA-covered entities, disclosed a data breach affecting **1,396,519 individuals** after attackers gained access to a limited portion of its environment through a targeted phishing attack. The company said unauthorized activity began on January 20, 2026, was detected on January 22, and was then contained by terminating the intruder’s access. The incident has been reported to the US Department of Health and Human Services Office for Civil Rights and added to the HHS breach tracker, confirming the scale of the exposure. The compromised files contained personal and protected health information received from Xsolis clients, including names, dates of birth, addresses, Social Security numbers, health insurance details, and medical treatment information. Xsolis said the data may have been copied, but it has found no evidence of actual or attempted misuse so far and no ransomware group has claimed responsibility. Confirmed affected healthcare clients include **VHC Health** and **Rochester Regional Health**, and Xsolis is offering 12 months of credit monitoring and identity theft protection through **Kroll**.
Jun 29, 2026
Healthcare Interactive, a company specializing in AI-driven medical insurance benefit enrollment and billing solutions, confirmed a significant data breach that resulted in the exfiltration of sensitive customer data by hackers. The compromised information included names, dates of birth, Social Security numbers, contact details, health insurance enrollment data, patient diagnoses, provider names, lab results, medical images, and treatment plans. The breach also involved medical claims data, such as account numbers and billing codes. The incident occurred between July 8 and July 12, 2025, but was only detected around July 22, prompting the company to notify regulators and launch an internal investigation. The method of intrusion was not disclosed, leaving uncertainty about whether social engineering or phishing was involved. In a separate but related trend, Allianz Life, a major American insurance provider, reported a data breach in July 2025 that affected nearly 1.5 million individuals, including customers, financial professionals, and employees. The breach was traced to unauthorized access of a third-party cloud-based CRM system, with the ShinyHunters extortion group suspected to be behind the attack. Exposed data included names, addresses, dates of birth, and Social Security numbers, though earlier reports suggested additional information such as email addresses and phone numbers may have been compromised. Allianz Life has since notified affected individuals and authorities, and provided instructions for protective measures. Another incident involved ClaimPix, an Illinois-based auto insurance claims platform, where a misconfigured and unencrypted database exposed over 5.1 million files, totaling 10.7 terabytes of data. The exposed records included personal identifiable information, insurance documents, vehicle registrations, repair invoices, and images of damaged vehicles, as well as sensitive Power of Attorney documents that could facilitate fraud or impersonation. Archer Health, a U.S. provider of palliative and in-home care services, also suffered a data exposure due to a misconfigured database, leaking nearly 145,000 health records containing names, Social Security numbers, diagnostic details, and treatment plans. The company responded by securing the database and initiating an investigation, though it remains unclear if the data was accessed by malicious actors. These incidents collectively highlight a pattern of significant data breaches affecting the insurance and healthcare sectors, often involving misconfigured cloud storage or third-party service vulnerabilities. The breaches have exposed millions of individuals' sensitive personal and health information, raising concerns about the adequacy of cybersecurity measures in these industries. Regulatory notifications and investigations have been initiated in each case, but the full impact on affected individuals and organizations is still being assessed. The incidents underscore the critical need for robust data protection, regular security audits, and stringent oversight of third-party service providers. The exposure of highly sensitive data, including medical diagnoses and legal documents, increases the risk of identity theft, fraud, and other malicious activities. Organizations are urged to review their cloud security configurations and incident response protocols to prevent similar breaches. The healthcare and insurance sectors remain prime targets for cybercriminals due to the value of the data they hold. These breaches serve as a stark reminder of the evolving threat landscape and the importance of proactive cybersecurity strategies.
Jun 29, 2026