Outcomes One, Inc. outcomesone.com Outcomes One data breach: what happened and what to do
Outcomes One, a health technology vendor, reported that a phishing email compromised an employee's account in July 2025. About 257,000 people were affected. Exposed data included names, dates of birth, medications and other treatment information.
View all 13,115 breaches- Breach date
- Jul 2025
- Made public
- 23 Sept 2025
- Affected
- 257,481
- Data exposed
- Names, Dates of birth, Medications, Treatment information
- Last updated
Outcomes One, Inc. is a Florida company that provides medication management and adherence technology to health plans. In 2025 it reported a breach caused by an email phishing scheme aimed at one of its employees.
What happened
The incident began on July 1, 2025, when an employee responded to a phishing email and an unauthorized person gained access to that employee's email account. Reports say the company spotted and shut down the access within about an hour. Outcomes One notified the U.S. Department of Health and Human Services, which lists the breach as affecting 257,481 people. A filing with the California Attorney General's office shows it was reported there in September 2025, and the people affected were members of health plans that use the company's services.
What was exposed
The U.S. Department of Health and Human Services describes the data as names, dates of birth, medications and other treatment information. That is enough for a scammer to build a believable message that quotes your real prescriptions, which is a common way to get people to click a link or hand over a card number.
What the company did
Outcomes One says it notified the affected health plans, the people involved and the media, added administrative, technical and security safeguards, and retrained its staff to spot phishing emails.
What to do if you were in it
- 1
Read the notice letter
If you got a letter, it says what was in your file. Keep it with your records.
- 2
Expect phishing that mentions your health plan
Be wary of calls, texts and emails about your medications or insurance, even ones with accurate details. Contact your plan using the number on your insurance card.
- 3
Check your insurance statements
Look through explanation of benefits statements for claims you don't recognize and report them to your plan.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details show up, so you know what to act on. It can't remove data from a breach, but it tells you what to do next.
Frequently asked
Was I affected by the Outcomes One breach?
If you were affected you should have received a letter. If you're a member of a health plan that works with Outcomes One and haven't heard anything, contact your plan.
What data was exposed?
Names, dates of birth, medications and other treatment information, according to the U.S. Department of Health and Human Services.
Should I change my password?
The notice doesn't mention passwords, so there is nothing to change because of this breach. Be careful with messages that use your health details.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
