FEDERALSocial EngineeringHealthcareTechnologyHealthcarePhishingStolen CredentialsMulti-Stage ChainCustomer Data InvolvedDelayed DiscoveryPIIIdentity (basic)Health (basic)LowActive

Hims & Hers Health, Inc.

bd_0cc210b877a07d46 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 1, 2026

Filed

Feb 23, 2026

To disclose

22 days

Affected

Not disclosed

Linked

4 filings

Confidence

64%

Full breach record for Hims & Hers Health, Inc. →

Hims & Hers Health disclosed a cybersecurity incident in its 10-K filing. In early February 2026, an unauthorized third party gained access to systems via social engineering/phishing of two employees. The actor accessed customer service software, obtaining PII (names, emails, addresses) and potentially treatment category data for customers active between Feb 2025 and Feb 2026. EMRs were not accessed. The investigation is ongoing, and notifications are pending. The company does not believe the incident is materially impactful to financials.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 351 days

discovery → filing · 22 days

Feb 15, 2025

Begins

Feb 1, 2026

Discovered

Feb 23, 2026

Filed

vs. sector median

9 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_3ace3aee1cea21e82026-04-02 · +38dVerified
Vermont State AGbd_af58dc468106a80b2026-04-02 · +38dVerified
Texas State AGbd_92ad67154a74fee82026-04-06 · +42dVerified

Name: Hims & Hers Health, Inc.
norm: hims hers health
Domain: hims.com

Name: Hims & Hers Health, Inc.
norm: hims hers health
Domain: hims.com
Industry: HealthcarellmTechnologyllm

Discovered: Feb 1, 2026
Breach occurred: Feb 15, 2025 – Feb 1, 2026
Undetected for: 351 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIIdentity (basic)Health (basic)
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid Accounts
Threat actor: External
Regulator citations: coordinating with law enforcement
Initial access: phishing_link

During the incident: Initiated our cybersecurity response plans
Took steps to assess, contain, and remediate the unauthorized activity
Isolating the affected systems
Launching an investigation with the assistance of external cybersecurity advisors
Coordinating with law enforcement
Changes made: We have aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework
Conduct continuous vulnerability scanning and periodic penetration tests
Utilize a Security Information and Event Management (SIEM) tool and Security Operations Center (SOC) provider
Employ a dedicated cybersecurity team
Periodic NIST-based risk assessment is performed by an independent third party
Regularly train our employees on cybersecurity awareness, confidential information protection, and phishing attacks
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

SEC 10-K Item 1CFeb 23 · first · this page

California State AG+38d

Vermont State AG+38d

Texas State AG+42d

Pattern: first filing Feb 23, last Apr 6 (TX) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1773751/000177375126000022/hims-20251231.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 23, 2026
Raw hash: 943870e75487a388f7a57a21c0c60b9821e2ec6650a1615dcc331298e9b03355

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.4 MB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHims & Hers Health, Inc.

Victim entityHims & Hers Health, Inc.

Incidentdiscovered Feb 1, 2026

Stated responseInitiated our cybersecurity response plans

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing