HackingHealthcareTechnologyHealthcareVulnerability ExploitCapture Stored DataZero-DaySupply Chain (3P Vendor)Downstream VictimsCustomer Data InvolvedData ExfiltratedPIIPHILowContained

PHREESIA, INC.

bd_26337698165afc92 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Feb 6, 2026

To disclose

—

Affected

Not disclosed

Linked

3 filings

Confidence

86%

Full breach record for PHREESIA, INC. →

Phreesia, Inc., a healthcare patient check-in technology company, was impacted by a zero-day vulnerability in third-party software Salesloft Drift, which allowed an unknown threat actor to access Salesforce environments of hundreds of organizations on August 17, 2025. Service tickets containing limited patient information were exposed. 18 Rhode Island residents were identified as affected. Phreesia stopped use of the tool, engaged external cybersecurity experts, and offered two-year Kroll identity monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

Aug 17, 2025

Begins

Feb 6, 2026

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Texas State AGbd_38249521c5279ffc2026-02-06Verified
Illinois State AGbd_d918451b34f8e35a2026-02-01 · +5dVerified

Name: PHREESIA, INC.
norm: phreesia
Domain: phreesia.com

Name: PHREESIA, INC.
norm: phreesia
Domain: phreesia.com
Industry: HealthcarellmTechnologyllm

Discovered: —
Breach occurred: Aug 17, 2025
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PIIPHI
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1195 Supply Chain CompromiseT1530 Data from Cloud Storage Object
Threat actor: External
Third party: via Salesloft Drift
Initial access: exploit_public_facing

During the incident: Immediately stopped using the affected software (Salesloft Drift)
Took steps to secure our Salesforce environment, including turning off Salesloft Drift
Launched an investigation, with support from external cybersecurity experts, to assess the impact of the incident on our environment or data
Arranged for affected individuals to enroll in a complimentary two-year identity and credit monitoring service provided by Kroll
Changes made: Adding new security measures
Reviewing our third-party risk management practices
Source: Quoted from the filing itself, not independently verified.

Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Illinois State AGFeb 1 · first

Texas State AG+5d

California State AG+5d · this page

Pattern: first filing Feb 1 (IL), last Feb 6 (CA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-618283
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 6, 2026
Raw hash: b0ec72aa63f2b20122c0d61f80ad404543c88d1d44fd332f510be9151d04c23a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityPHREESIA, INC.

Victim entityPHREESIA, INC.

IncidentThird-Party / Supply Chain

Stated responseImmediately stopped using the affected software (Salesloft Drift)

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov