Outcomes One, Inc., a vendor providing medication therapy management and medication adherence services to health plans, experienced an email-phishing data breach that occurred on July 1, 2025. The company secured the account and launched an investigation the same day. Notices to affected individuals began around September 23, 2025. Regulatory filings confirming the breach were made with various state attorneys general.
The exposed data included names, demographic information, medical provider names, health insurance information, and medication information. While reports explicitly state that Social Security numbers were not involved, medical and health insurance data were compromised. The estimated number of affected individuals ranges from at least 149,904 to 257,481, with the discrepancy likely reflecting different counting methods across notices and client populations. The exact number of affected individuals for some clients has not been publicly confirmed.
More details about this incident may emerge over time, and some individuals may receive notifications at later dates. The full scope and impact are still being assessed.