HackingHealthcareRetail & ConsumerHealthcareStolen CredentialsSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Health (basic)LowContained

Hims & Hers Health, Inc.

bd_3ace3aee1cea21e8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 5, 2026

Filed

Apr 2, 2026

To disclose

8 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Hims & Hers Health, Inc. →

Hims & Hers, Inc. disclosed that from February 4-7, 2026, unauthorized parties accessed customer service tickets on a third-party platform. The incident involved names, contact info, and potentially health-related data for a limited set of individuals. Hims & Hers secured the platform, notified law enforcement, and is offering 12 months of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 8 weeks / 56 days

Feb 4, 2026

Begins

Feb 5, 2026

Discovered

Apr 2, 2026

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Vermont State AGbd_af58dc468106a80b2026-04-02Verified
Texas State AGbd_92ad67154a74fee82026-04-06 · +4dVerified
SEC 10-K Item 1Cbd_0cc210b877a07d462026-02-23 · +38dCandidate

Name: Hims & Hers Health, Inc.
norm: hims hers health

Name: Hims & Hers Health, Inc.
norm: hims hers health
Industry: HealthcarellmRetail & Consumerllm

Discovered: Feb 5, 2026
Breach occurred: Feb 4, 2026 – Feb 7, 2026
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Apr 2, 2026
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified federal law enforcementWill notify relevant regulators, as required
Third party: via third-party customer service platform
Initial access: trusted_relationship

During the incident: Promptly took steps to secure our customer service platform
Initiated an investigation into the nature and scope of the potential security incident
Undertook a comprehensive review of the affected service tickets to determine what information was present and to whom it relates
Notified federal law enforcement
Offering complimentary credit monitoring and identity restoration services for 12 months through Cyberscout
Changes made: Reviewing our policies and procedures to reduce the likelihood of similar future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

SEC 10-K Item 1CFeb 23 · first

Vermont State AG+38d

California State AG+38d · this page

Texas State AG+42d

Pattern: first filing Feb 23, last Apr 6 (TX) — a 42-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-621205
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 2, 2026
Raw hash: 2ab514c0638d639674db87e0e953887aa867df515a844a06d18cb4c95b021d09

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHims & Hers Health, Inc.

Victim entityHims & Hers Health, Inc.

Incidentdiscovered Feb 5, 2026

Stated responsePromptly took steps to secure our customer service platform

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov