Amazon’s One Medical Senior Health Announces Data Breach, ShinyHunters Claims Stealing 8.8 TB
Published
Key Takeaways
- Breach Detected: One Medical Senior Health found that an unauthorized person accessed a third-party file storage system holding archived Iora Health data on June 13.
- Limited Scope: The company’s breach announcement said only certain legacy Iora Health and One Medical Seniors patient files were accessed.
- Hacker Claim: ShinyHunters claims responsibility, alleging the theft of 8.8 TB of data from Amazon’s One Medical.
One Medical Senior Health, formerly known as Iora Health, has disclosed a data breach affecting archived patient records. On June 13, the Amazon-owned company learned that an unauthorized person had gained access to a third-party file storage system used to retain archived information from Iora Health, which One Medical acquired in 2021.
What Data Was Accessed
The investigation into the One Medical data breach determined that certain patient files related to a limited number of legacy Iora Health and One Medical Seniors patients were accessed. The announcement said no other One Medical patients were impacted by the intrusion.
The healthcare company emphasized that the incident was isolated to the third-party file storage system and that no other One Medical or Amazon systems were affected.
Separately, the ShinyHunters hacking group recently claimed responsibility for breaching One Medical and allegedly stealing 8.8 TB of data.
One Medical Breach Fallout
One Medical Senior Health said it immediately took action to deactivate the system and revoke all access after detecting the unauthorized access. The company added that it launched a thorough investigation into the incident, which centered on the affected third-party storage environment.
In other recent news, Kodak confirmed a data breach following ShinyHunters' claims that it stole 2.2 million records, and Australian Clinical Labs reported a SunDoctors data breach.
The threat actor made headlines last year after claiming attacks against hundreds of Salesforce customers through Salesforce and Salesloft Drift operations, then announcing “almost 1,000” victims.
Recently, the extortion group also claimed to have exploited a zero-day flaw in Oracle PeopleSoft enterprise software, tracked as CVE-2026-35273, which it allegedly used to breach the Council of Europe.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular