One Medical onemedical.com One Medical data breach: what happened and what to do
One Medical said an unauthorized person reached a third-party file storage system holding archived One Medical Seniors (formerly Iora Health) files between June 8 and 11, 2026. The files held demographic and clinical records. The company hasn't published how many patients were affected.
View all 13,177 breaches- Breach date
- 8 Jun 2026
- Made public
- 17 Jun 2026
- Data exposed
- Demographic information, Medical information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
One Medical said it learned on June 13, 2026 that an unauthorized person had gained access to a third-party file storage system. The system held archived information for One Medical Seniors, the unit that used to be Iora Health. According to the company, the person could reach patient files in that system between June 8 and June 11, 2026.
What was exposed
The company describes the files as demographic and clinical records from legacy systems. It says the affected patients are legacy Iora Health and One Medical Seniors patients at certain clinics, and that other One Medical patients and its electronic medical record system were not involved. It has not published a count of affected patients.
Demographic records can include the details that identify you, and clinical records describe your care. Together they give scammers material for convincing phone calls, texts and letters that mention a real clinic or a real condition. Medical details are also hard to change once they're out.
The company's response
One Medical says it secured the system, revoked access, notified law enforcement and is contacting affected patients directly. If you were a patient at one of the legacy clinics, look for that letter and read it for what it says was in your file and whether it offers credit monitoring or identity protection.
What this means for you
If you get a call, email or text about your care, your insurance or a bill, don't use the contact details in the message. Look up the number on your card or the clinic's own site. If the letter says Social Security numbers or insurance details were involved, the FTC's steps for that apply: a credit freeze and a close look at your statements.
Sources checked: onemedical.com, fiercehealthcare.com, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Read the notice you received
If you were a One Medical Seniors or Iora Health patient, the company is notifying people directly. The letter says what was in your file and what protection it offers. The FTC recommends taking free credit monitoring if it's offered.
- 2
Be wary of calls and messages about your care
Scammers use real medical details to sound credible. Don't act on a call, email or text you didn't start. Hang up and call the number on your insurance card or the clinic's official site.
- 3
Check your insurance statements
Read your explanation of benefits and bills for services you didn't receive. Report anything odd to your insurer.
- 4
Freeze your credit if the letter lists SSNs or financial details
A freeze is free and stops new accounts being opened in your name. You place it separately with Equifax, Experian and TransUnion. The FTC explains how at consumer.ftc.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you, so you can act when your details show up.
Official filings
- U.S. Department of Health and Human Services , filed 17 Jul 2026 : 153,174 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the One Medical breach?
The company says the affected people are legacy Iora Health and One Medical Seniors patients at certain clinics, and that it is notifying them directly. Other One Medical patients were not affected, according to the company.
What was exposed?
One Medical describes the files as demographic and clinical records. It hasn't published a complete list of data types.
How many people were affected?
One Medical hasn't published a number in its notice.
Should I change my password?
The company hasn't said passwords were involved. If you reuse your One Medical password on other accounts, changing it is still a sensible step, and turn on two-factor login where you can.
Sources
- onemedical.com/security-event-notice/
- fiercehealthcare.com/health-tech/one-medical-seniors-reports-data-breach-third-party-file-storage-system
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- identitytheft.gov/databreach
Something wrong or out of date? Tell us and we'll re-check it.
