One Medical, a primary care provider owned by Amazon, disclosed a data breach in 2026. The incident involved unauthorized access to a legacy third-party file storage system holding archived records from its 2021 acquisition of Iora Health. The breach occurred between June 8 and June 11, 2026, and was discovered on June 13, 2026.
The breach affected over 153,000 patients. Exposed data included names, contact information, dates of birth, Social Security numbers, medical records, treatment plans, diagnostic information, imaging, prescriptions, Medicare numbers, health insurance details, and billing-related information. At least 10,041 Texas residents and 5,410 Massachusetts residents were impacted. The full extent of individuals affected across all states has not been publicly detailed beyond the initial disclosure.
More details may emerge as investigations continue, and specific consumer notifications might follow different timelines depending on state regulations.