One Medical: After cyberattack on Amazon's health service, data leak threatened

One Medical has confirmed an IT security incident. According to the Amazon subsidiary, unknown parties gained access to a third-party file storage system between June 8 and 11, 2026, which contained archived patient data from One Medical Seniors and the acquired health organization Iora Health. The incident was discovered on June 13; the company blocked access and initiated an investigation.

Iora Health specialized in the care of elderly patients and was acquired by One Medical in 2021. One Medical describes itself as a digitally supported healthcare access provider, available around the clock via phone or an online form. Iora Health now operates under the name One Medical Seniors. According to a notice , the incident exclusively affects certain legacy data of One Medical Seniors.

To the best of current knowledge, demographic and clinical data of patients from the locations previously connected according to the website in Atlanta, Cape Cod, Charlotte, Denver, Houston, Phoenix, Seattle, Tucson, and the Piedmont Triad region are affected. Other One Medical clinics, services, or the electronic patient record system are not impacted. The company intends to notify affected patients after the investigation is complete.

The ransomware group ShinyHunters claims to have exfiltrated 8.8 terabytes of data from One Medical and threatens to publish it if negotiations are not opened by June 22.

One Medical has been part of Amazon since 2023. The group had already announced the acquisition of the operator of health centers and telemedicine services in 2022. For around 3.5 billion US dollars, Amazon acquired the company 1Life Healthcare, which operates more than 180 health centers in the USA under the One Medical brand. With this acquisition, Amazon significantly expanded its activities in the healthcare sector.

The incident also raises questions the handling of acquired legacy systems. Following the attack on Change Healthcare, UnitedHealth admitted that after the company's acquisition in 2022, different systems initially had to be brought to a common security standard. Change Healthcare operates central billing and payment services for hospitals, doctors, pharmacies, and insurance companies in the USA.

The attackers had gained access via compromised credentials to a Citrix portal used for remote access to systems, which was not secured with multi-factor authentication. The incident affected almost 200 million people, primarily from the USA.

Both One Medical and UnitedHealth were already the subject of critical reporting before their respective security incidents. While organizational problems in patient care were discussed at One Medical , UnitedHealth has been under scrutiny for years due to its size, market power, and business practices; it was even referred to as the “most hated insurer” according to Die Zeit .

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.