One Medical Faces Extortion Threat as ShinyHunters Claims Massive Data Theft Amazon-owned primary care provider One Medical is under scrutiny after the cybercriminal group ShinyHunters alleged it stole 8.8 terabytes of company data, threatening to publish the information unless negotiations begin by June 22. The claim remains unverified, as the group has not provided sample data to substantiate its assertions. One Medical serves over 830,000 patients across 250+ clinics and virtual care platforms in the U.S., making the potential breach particularly concerning. If legitimate, the exposed data could include medical records and personal identifiers, which are highly valuable to cybercriminals for identity theft and targeted fraud. The extortion attempt follows a separate, confirmed incident disclosed by One Medical earlier this month. An unauthorized party accessed a third-party file storage system containing archived records from legacy Iora Health patients. The company stated the breach was limited in scope, affecting only a subset of One Medical Seniors and former Iora Health patients, and did not impact other One Medical or Amazon systems. Access was revoked, and affected individuals are being notified. ShinyHunters, known for high-profile data thefts across industries including technology, retail, and government typically focuses on data exfiltration and leaks rather than traditional ransomware attacks. The group’s history of targeting major organizations adds weight to the current threat, though the lack of evidence leaves the claim’s validity in question. One Medical has not publicly confirmed the extortion demand, and the situation remains under investigation. The timing of the two incidents has intensified scrutiny of the healthcare provider’s cybersecurity measures.

Amazon One Medical Reports Data Breach Affecting Senior Care Patients Amazon’s One Medical disclosed a security incident on June 13, 2024, after an unauthorized party accessed a third-party file storage system containing archived data from Iora Health, a Medicare-focused primary care provider acquired by One Medical in 2021. The breach impacted a "limited number" of patients from One Medical’s senior care clinics, which now operate under the rebranded One Medical Senior Health. The company confirmed that the compromised system stored legacy patient files from Iora Health and affected individuals, though the exact number of impacted patients remains undisclosed. One Medical stated that no other One Medical or Amazon systems were involved, and the incident was contained to the third-party storage platform. Immediate actions were taken to deactivate the system and revoke access, followed by an internal investigation. One Medical is directly notifying affected patients and has pledged to implement additional safeguards to prevent future breaches. The acquisition of Iora Health in 2021, which served approximately 39,000 Medicare patients across 46 clinics at the time, was part of Amazon’s broader $3.9 billion purchase of One Medical, finalized in February 2023. The breach highlights ongoing risks in healthcare data security, particularly for legacy systems integrated into larger platforms.

One Medical, Inc. suffered a data breach after an unauthorized party gained access to sensitive consumer data that had been entrusted to the company. The breach compromised the names, addresses, Social Security numbers, and medical information of certain individuals including about 964 people in Texas.