Oscar Health hioscar.com Oscar Health data breach: what happened and what to do
Oscar Health told HHS that an employee mailed the health information of 91,350 people to the wrong recipients. The data was clinical and demographic. HHS lists the case in February 2026.
View all 13,177 breaches- Breach date
- 27 Feb 2026
- Made public
- 27 Feb 2026
- Affected
- 91,350
- Data exposed
- Clinical information, Demographic information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Oscar Health, Inc. reported to the U.S. Department of Health and Human Services (HHS) that an employee mailed the protected health information of 91,350 people to the wrong recipients. HHS added the case to its breach list in February 2026. This was a mailing error, not a hack.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS says the information involved was clinical and demographic. It doesn't list passwords, payment cards or Social Security numbers. Mail sent to the wrong address can still tell a stranger that you have a health plan and what care you've had, and it can be used to write convincing scam letters or calls that mention your coverage.
The response
HHS says Oscar notified HHS, the affected people and the media, and corrected its mailing system. HHS's Office for Civil Rights gave Oscar technical assistance on the HIPAA Rules.
Why a mailing error still counts
Under HIPAA, health information sent to the wrong person is a breach even when nobody hacked anything. The people who received the mail by mistake could read details about someone else's health plan. HHS doesn't say that anyone misused the information, and it doesn't list the kind of identifiers, such as Social Security numbers, that open the door to identity theft. The practical risk is targeted scams that quote your plan, so the steps below focus on that.
What to do if you were in it
- 1
Expect scams that mention your health plan
Treat calls, texts and letters that reference your insurance with suspicion. Contact Oscar through the phone number on your member card, not one in the message.
- 2
Check your insurance statements
Read explanation-of-benefits statements for care you didn't receive and report anything unusual to your insurer.
- 3
Know the credit freeze option
Social Security numbers were not listed as exposed, so a freeze isn't required. If you want extra protection, the FTC explains how to freeze your credit at Equifax, Experian and TransUnion.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see whether your email address or phone number shows up in known breaches. Serus monitors breach databases and the dark web and alerts you if your data appears, and tells you what to do next. It can't remove data from a breach, so the steps here are what protect you.
Official filings
- U.S. Department of Health and Human Services , filed 27 Feb 2026 : 91,350 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Oscar Health breach?
HHS says 91,350 people were affected and that Oscar notified them. Check your mail for a notice from Oscar.
What was exposed?
HHS describes clinical and demographic information. It doesn't list Social Security numbers or passwords.
Should I change my password?
No. The cause was paper mail sent to the wrong people, and no login details were listed as exposed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
