OutcomesOne, a Florida-based medication therapy management firm, suffered a targeted hour-long phishing attack on July 1, 2025, compromising a single employee’s email account. The breach exposed protected health information (PHI) of nearly 150,000 individuals, including names, demographic details, medical provider names, health insurance data (specifically Aetna plan members), and medication records. While Social Security numbers were unaffected, the attacker accessed sensitive files and emails within the compromised account. The incident was swiftly reported and contained, but the exposed data triggered potential class-action lawsuits and regulatory scrutiny. The breach underscores persistent vulnerabilities in healthcare cybersecurity, particularly from phishing-as-a-service (PhaaS) attacks, which now account for 35% of ransomware entry points in 2025. Despite rapid response, the scale of affected individuals and the nature of compromised PHI highlight systemic risks in email-based threats.