One Medical (Amazon)

Between June 8 and June 11, 2026, an unauthorized third party accessed a file storage system containing legacy patient data from One Medical Seniors (formerly Iora Health). One Medical identified the breach on June 13. ShinyHunters posted the claim to their dark web site on June 17, demanding negotiations by June 22 before publishing.

One Medical operates over 250 clinics serving 830,000+ patients. Amazon acquired the company for $3.9 billion in 2023. The breached system contained archived data from Iora Health, which One Medical acquired in 2021 for $2.1 billion.

ShinyHunters claims 8.8 terabytes. Samples posted to dark web forums have been independently verified as authentic patient records. The confirmed data types include patient names, dates of birth, insurance information, diagnoses, and treatment notes.

The breach affected former Iora Health/One Medical Seniors patients in Atlanta, Cape Cod, Charlotte, Piedmont Triad, Denver, Houston, Phoenix, Tucson, and Seattle. This is senior-focused primary care—the patient population skews older and the medical records are comprehensive. Chronic conditions, long treatment histories, detailed health documentation.

Senior patients whose complete medical histories are now in attacker hands. Names and dates of birth enable identity theft. Insurance information enables medical identity fraud—fake claims, prescription fraud, benefits exhaustion. Diagnosis information is permanent—you cannot change your medical history.

This population is vulnerable. Older patients are prime targets for healthcare-themed phishing and phone scams. An attacker who knows your doctor's name, your diagnoses, and your insurance provider can construct highly convincing fraud attempts. The harm extends beyond financial loss to emotional distress and erosion of trust in healthcare systems.

One Medical emphasized that their main electronic medical record system was not compromised. The breach was "limited to the file storage platform" containing "legacy data." The core clinical systems remain secure. Current operations continue normally.

But "legacy data" is still patient data. Protected health information doesn't lose its protection because it's old or archived. The file storage system that was breached still fell under HIPAA requirements. The distinction between legacy and current systems matters for business continuity—it doesn't matter at all for the patients whose records were stolen.

When Amazon acquired One Medical, they inherited a complex data landscape. One Medical had already acquired Iora Health. Each acquisition brought patient databases, file storage systems, and archived records. The breached file storage contained data from a company that was acquired five years ago.

8.8 terabytes is a substantial volume of healthcare data. Did anyone at Amazon or One Medical know exactly what was in that legacy file storage? Did they inventory the PHI accumulated across multiple acquisitions? The attack surface was created by corporate transactions—M&A integration rarely includes comprehensive data inventory of what sensitive information came with the deal.

HIPAA requires notification within 60 days of discovery for breaches affecting 500+ individuals. This breach spans nine geographic markets. Each affected patient must be individually notified. The volume of 8.8 terabytes suggests substantial review is needed to determine exactly whose records were accessed.

Amazon's involvement elevates the visibility. HHS OCR will investigate. State attorneys general may initiate inquiries. Class action attorneys are already advertising. The operational burden of HIPAA breach response—forensic investigation, individual notification, credit monitoring, regulatory reporting—begins immediately and extends for months.