Hims & Hers Discloses Third-Party Data Breach Affecting Customer Support Tickets Hims & Hers, a U.S.-based telehealth company, reported a data breach involving unauthorized access to its third-party customer service platform. The incident, detected on February 5, 2026, exposed personal information from service tickets submitted between February 4 and 7, 2026. The breach targeted support requests managed by an external vendor, where customer interactions including names and contact details were accessed without authorization. The company confirmed on March 3, 2026, that a limited number of individuals were affected, though the total figure remains undisclosed. Notably, medical records and provider communications were not compromised. Hims & Hers responded by securing the platform and launching an investigation. Affected individuals were notified via letters dated April 2, 2026, and offered 12 months of complimentary credit monitoring and identity restoration services through Cyberscout (a TransUnion subsidiary). The services include single-bureau credit monitoring, fraud alerts, and proactive assistance. Enrollment requires a unique code from the notification letter and must be completed within 90 days. The company reported the breach to the California Attorney General and provided a dedicated support line (1-833-319-5614) and mailing address for inquiries. No further details on the breach’s origin or the threat actor involved have been released.

Hims & Hers Hit by Sophisticated Social Engineering Attack in February Hims & Hers, a San Francisco-based telehealth provider with 2.5 million subscribers, disclosed a social engineering attack that compromised its third-party customer service platform in early February. According to regulatory filings, an unknown attacker gained unauthorized access to service tickets between February 4 and 7, with suspicious activity detected on February 5. The company confirmed that the breach was limited to its customer service software, with exposed data primarily including customer names and email addresses. While electronic medical records and provider communications remained secure, the attackers may have accessed treatment information for certain customers who engaged with customer service between February 2025 and February 2026. The attack targeted two employees, as outlined in the company’s February 22 SEC filing (10-K). Hims & Hers reported no material financial impact from the incident but has notified law enforcement and is reviewing internal policies to prevent future breaches. The company recently expanded its services through a partnership with Novo Nordisk to offer FDA-approved weight-loss medications.