OncoHealth, Inc., a digital health company specializing in oncology-centered technology, experienced a significant data breach on September 4, 2025, when a phishing attack compromised its Zendesk customer service system. A fraudulent Zendesk account was mistakenly included in an email sent to Humana Inc., containing a file with protected health information (PHI)—including first/last names, dates of birth, Humana ID numbers, and authorization numbers. The impersonator gained access to this sensitive data before the account was deactivated on September 5, 2025.The breach exposed personally identifiable information (PII) of customers, putting them at risk of identity theft, fraud, and financial harm. OncoHealth notified affected individuals on October 10, 2025, and reported the incident to the Maine Attorney General’s office on November 20, 2025. The breach stemmed from a phishing scam targeting employee communications, leading to unauthorized access to patient and partner data. Legal investigations are underway, with affected individuals potentially eligible for compensation due to the exposure of sensitive health and identification details.

On Nov. 20, 2025, OncoHealth, Inc., a digital health company specializing in oncology solutions, disclosed a data breach caused by a fraudulent Zendesk account being mistakenly included in an email distribution to Humana Inc. The breach resulted in the inadvertent exposure of a file containing protected health information (PHI) and personally identifiable information (PII), including first and last names, dates of birth, Humana identification numbers, and authorization numbers. The exposed data was sent to an impersonator’s email alongside intended recipients.The incident was discovered on Sept. 4, 2025, with the breach originating from an Aug. 26, 2025 email. The exposure of PHI and PII poses risks of identity theft and medical fraud for affected individuals. OncoHealth began notifying impacted parties via mail on Oct. 10, 2025, and reported the breach to the Maine Attorney General’s office on the disclosure date.In response, the company implemented stricter internal controls, enhanced staff security awareness, and updated Zendesk system protections. The breach stemmed from a human error in email distribution, leading to unauthorized access to sensitive health and personal data.