One Medical

Summary

One Medical reported that an unauthorized party accessed a third‑party file storage system used to store archived records of its acquired senior‑care business, resulting in the exposure of a limited number of patient files. The company said it promptly disabled the system, revoked access, launched an investigation, and is notifying the affected individuals, noting that no other patient data or internal systems were compromised.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

One Medical acquired Iora Health in June 2021 for $2.1 billion. Iora Health provided care to approximately 39,000 patients across 46 senior-focused clinics in July 2021. Iora Health was rebranded in 2023 and now operates as One Medical Senior Health. On June 13, 2026, One Medical learned that an unauthorized person gained access to a third-party file storage system used to retain archived information of Iora Health. The company described the event as a security incident affecting a limited number of patients of its senior care clinics.

Upon discovery, One Medical immediately deactivated the system and revoked all access. It launched a thorough investigation into the breach. The investigation determined that certain patient files related to a limited number of One Medical Seniors and legacy Iora Health patients were accessed. The company stated that no other One Medical patients were impacted by the security event. One Medical began notifying affected patients directly about the breach. The company said it takes the security of patient information seriously and is implementing additional safeguards to prevent similar events in the future.

The incident was isolated to the third-party file storage system, with no other One Medical or Amazon systems affected. Amazon announced its plan to acquire One Medical for $3.9 billion in 2022 to grow its healthcare business. The acquisition, which included Iora Health, closed in February 2023. The breach did not extend to any other systems within the combined organization.

Sources

Sources available to members: 2 sources.