Phreesia phreesia.com Phreesia data breach: what happened and what to do
Phreesia, a patient check-in software company, reported that a third party reached its Salesforce customer-service tickets on August 17, 2025 through a flaw in Salesloft Drift. Phreesia says medical charts and payment details weren't accessed.
View all 13,115 breaches- Breach date
- 17 Aug 2025
- Made public
- 6 Feb 2026
- Last updated
What happened
Phreesia helps healthcare providers run patient check-in and paperwork. In a notice filed with the California Attorney General, it says it learned on August 25, 2025 that it was one of many organizations hit through a third-party tool called Salesloft Drift. An unknown party exploited a previously unknown flaw in that tool and got into the Salesforce environments of hundreds of organizations, Phreesia's among them.
Phreesia says the flaw wasn't in its own systems. Its investigation found the party had access to service tickets in Salesforce on August 17, 2025. California listed the notice in February 2026.
What was exposed
The tickets store what healthcare organizations send when they ask Phreesia for help. They sometimes include small amounts of patient information. The notice letter fills in the exact data types for each person, and the template doesn't list them, so check your own letter.
Phreesia says the party did not reach medical charts, payment card details or financial account information. It says it knows of no attempted or actual misuse.
What Phreesia did
Phreesia turned off Salesloft Drift, secured its Salesforce environment and brought in outside security experts. It says it added security measures and is reviewing how it manages third-party risk.
What to do if you were in it
- 1
Read your notice letter
The letter lists which of your details were in the tickets. Let that decide your next steps.
- 2
Watch your health insurance statements
Read explanation-of-benefits statements and look for services you didn't use. Report anything odd to your insurer.
- 3
Expect phishing that mentions your provider
Treat calls, emails and texts about billing or appointments with caution, even if they name your clinic. Call the clinic on a number you already have.
- 4
Freeze your credit if your notice lists identity numbers
If the letter lists a Social Security number or similar, freeze your credit for free at Equifax, Experian and TransUnion.
- 5
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and alerts you if they show up. It can't take data out of a breach, but it tells you what to change.
Frequently asked
Was I affected by the Phreesia breach?
If you were affected, Phreesia sends a notice letter. It got your data through your healthcare provider.
What was exposed?
Limited patient information in customer-service tickets. Phreesia says medical charts, payment cards and financial account details weren't accessed.
Where did the breach happen?
In Phreesia's Salesforce environment, through a flaw in the third-party tool Salesloft Drift, not in Phreesia's own systems according to the company.
Has the data been misused?
Phreesia says it knows of no attempted or actual misuse.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
